A software I wrote in C# that is scheduled to email me the stats nightly for the previous day. It also sends me weekly stats.
My software also analyzes the hold queue and sends an emial out if a user has any held email they can then click a link in the email to requeue the message. when they requeue a message the raw message is sent to the mail admin to analyze and determine how to allow it to pass in the future with out being held. this way I do not have to go through the held mail. each individual user does it. I have been running it with about 10 users for three days and they love it, they feel in control. I am going to be releasing the software to a few declude list members next week. Kevin Bilbee Sample email: ------------------------------------------------- Welcome to the Standard Abrasives SPAM filter hold queue report. The following is the email(s) sent to you that may be spam. You can click on the link under the message summary to move it from the "hold" queue to the "processing" queue for final delivery. If you recover a message a copy of that message is sent to the Mail Administrator for review. The review consists of calling the user to verify it is a legitimate email and not SPAM. If it is legitimate then the Mail Administrator will determine the best way for the mail to be delivered without being held on the server. Mail is held on the server for 14 days. After 14 days the mail is permanently deleted. If you have any questions please contact [EMAIL PROTECTED] ----------------------------------------------------------------------- Hold Count: 5 From: [EMAIL PROTECTED] Subject: Ultimate Encyclopedia and World Atlas Collection on 1 CD Date: Thursday, July 10, 2003 X-Spam-Tests-Failed: EASYNET-DNSBL, HELOBOGUS, IPNOTINMX, SPAMHEADERS, WEIGHT5, SPAM-MED [16] Recover: http://mail.standardabrasive.com/?3c6e1265feb From: [EMAIL PROTECTED] Subject: **Just Released! ***Explode your Sales/Leads! It Works! gWE%68% Date: Thursday, July 10, 2003 X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, SPAMDOMAINS, WEIGHT5, SPAM-MED [13] Recover: http://mail.standardabrasive.com/?40b8012001aa From: [EMAIL PROTECTED] Subject: Get Married or Get Laid Date: Thursday, July 10, 2003 X-Spam-Tests-Failed: OSSOFT, EASYNET-DNSBL, SBL, SPAMHEADERS, WEIGHT5, SPAM-MED [22] Recover: http://mail.standardabrasive.com/?43a01207db6 From: [EMAIL PROTECTED] Subject: In these times YOU NEED Life |nsurance Date: Thursday, July 10, 2003 X-Spam-Tests-Failed: DSBL, ORDB, BADHEADERS, HELOBOGUS, IPNOTINMX, SPAMHEADERS, WEIGHT5, SPAM-MED [22] Recover: http://mail.standardabrasive.com/?6ff00154b772 From: [EMAIL PROTECTED] Subject: Kevin, Rate Comparison Here... Below 4.25% Date: Thursday, July 10, 2003 X-Spam-Tests-Failed: EASYNET-DNSBL, SBL, IPNOTINMX, SPAMHEADERS, WEIGHT5, SPAM-MED [17] Recover: http://mail.standardabrasive.com/?9d050130a4c9 ---------------------------- -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of interactiveaustria Sent: Friday, July 11, 2003 12:24 AM To: [EMAIL PROTECTED] Subject: AW: [Declude.JunkMail] re: Spam Statistics Hi, got some overall statistics since I run Declude Junkmail Light (i.e. 07-02-2003 - not too long...) I did not count mail that passed all tests, and I could not count mail, that does not go to me except if the total weight is 15 or more. I decided if a mail is Spam or not. Mails received: 412 Spam Mails: 194 Positives: 216 Not sure: 2 Tests failed in Spam-Mail ========================= Test Weight # % ---------------------------------- BADHEADERS...........8...108...56% BASE64...............4....19...10% DNS..................3.....9....5% HELOBOGUS............6....47...24% IPNOTINMX............0...194..100% ipimmx..............-3.....0....0%* MAILFROM............12.....5....3% NOABUSE..............2....82...42% NOPOSTMASTER.........1....91...47% REVDNS...............4....67...35% ROUTING..............4....89...46% PERCENT.............10.....0....0% SPAMHEADERS..........3....29...15% ---------------------------------- WEIGHT10.................123...63% WEIGHT15..................69...36% WEIGHT20..................31...16% ---------------------------------- Min. Weight......................0 Max. Weight.....................25 Avg. Weight.....................12 ---------------------------------- Tests failed in Positives ========================= Test Weight # % ---------------------------------- BADHEADERS...........8.....1....0% BASE64...............4.....1....0% DNS..................3.....0....0% HELOBOGUS............6.....0....0% IPNOTINMX............0...205...95% ipimmx..............-3....11....5%* MAILFROM............12.....1....0% NOABUSE..............2.....6....3% NOPOSTMASTER.........1....25...12% REVDNS...............4....14....6% ROUTING..............4.....2....1% PERCENT.............10.....0....0% SPAMHEADERS..........3.....6....3% ---------------------------------- WEIGHT10...................1....0% WEIGHT15...................0....0% WEIGHT20...................0....0% ---------------------------------- Min. Weight......................0 Max. Weight.....................12 Avg. Weight......................1 ---------------------------------- Tests failed in "Not Sure" ========================== Test Weight # % ---------------------------------- BADHEADERS...........8.....0....0% BASE64...............4.....0....0% DNS..................3.....0....0% HELOBOGUS............6.....2..100% IPNOTINMX............0.....1...50% ipimmx..............-3.....1...50%* MAILFROM............12.....0....0% NOABUSE..............2.....0....0% NOPOSTMASTER.........1.....0....0% REVDNS...............4.....2..100% ROUTING..............4.....0....0% PERCENT.............10.....0....0% SPAMHEADERS..........3.....0....0% ---------------------------------- WEIGHT10...................1...50% WEIGHT15...................0....0% WEIGHT20...................0....0% ---------------------------------- Min. Weight......................7 Max. Weight.....................10 Avg. Weight......................9 ---------------------------------- * ipinmx is not really a test, I just use it to generate the weight of -3. I'm doing the statistics with a spreadsheet software (this is handmade and time-consuming - Kevin, what do you use?). Conclusion: I may raise the weight for DNS and HELOBOGUS, as they seem not to appear in the positives. Maybe BADHEADERS, BASE64 and MAILFROM as well, but not so much, and the ROUTING test a bit. But I want statistics for a longer period than one week before I do that. Who in Europe, esp. in Austria and/or other German-speaking areas, has similar (or different) experiences and is able to send me his settings, as far as they are different from the standard settings? Michael +--------------------------------------+ | interactiveaustria | | Michael Tobisch EDV-Dienstleistungen | | Wiesengasse 12, A-8160 Weiz | | Tel +43 3172 4930 | | GSM +43 664 2126941 | | EMail [EMAIL PROTECTED] | | Web http://www.iaa.at | +--------------------------------------+ | Kundeninformationen per E-Mail: | | http://www.iaa.at/kundeninfo.asp | +--------------------------------------+ > -----Ursprüngliche Nachricht----- > Von: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Auftrag von Kevin Bilbee > Gesendet: Donnerstag, 10. Juli 2003 20:59 > An: JunkMail Declude > Betreff: [Declude.JunkMail] re: Spam Statistics > > > I thought the group might want to see som spam stats. These are our stats > from yesterday. > > Does any one else have stats they could post so we can get an idea of what > test get triggered???? > > ------------------------------------------------------------- > LogFile(s) Scanned: > D:\IMAIL\spool\dec0709.log > ------------------------------------------------------------- > Total unique messages scanned: 1893 > Total failed messages : 1172 > Percent failed: 61.912 % > Total deleted messages: 425 > Percent deleted: 22.451 % > Total held messages : 120 > Percent held: 6.339 % > Total log file length : 24384 > ------------------------------------------------------------- > Test Name : Count % of Failed % of All > ------------------------------------------------------------- > BADHEADERS : 272 23.208 % 14.369 % > BASE64 : 33 2.816 % 1.743 % > BLITZEDALL : 65 5.546 % 3.434 % > BLOCKEDSENDERS : 22 1.877 % 1.162 % > BODYFILTER : 19 1.621 % 1.004 % > BONDEDSENDER : 23 1.962 % 1.215 % > COMMENTS : 32 2.730 % 1.690 % > DSBL : 178 15.188 % 9.403 % > DSN : 45 3.840 % 2.377 % > EASYNET-DNSBL : 458 39.079 % 24.194 % > EASYNET-DYNA : 16 1.365 % 0.845 % > EASYNET-PROXIES: 159 13.567 % 8.399 % > HELOBOGUS : 229 19.539 % 12.097 % > HELOFILTER : 151 12.884 % 7.977 % > IPBLACKLIST : 60 5.119 % 3.170 % > MAILFROM : 13 1.109 % 0.687 % > MONKEYPROXIES : 116 9.898 % 6.128 % > NOABUSE : 241 20.563 % 12.731 % > NOPOSTMASTER : 188 16.041 % 9.931 % > ORDB : 3 0.256 % 0.158 % > OSPROXY : 1 0.085 % 0.053 % > OSSOFT : 6 0.512 % 0.317 % > REVDNS : 211 18.003 % 11.146 % > ROUTING : 97 8.276 % 5.124 % > SBL : 217 18.515 % 11.463 % > SPAMCOP : 266 22.696 % 14.052 % > SPAMDOMAINS : 124 10.580 % 6.550 % > SPAMHEADERS : 187 15.956 % 9.879 % > SPAM-HIGH : 399 34.044 % 21.078 % > SPAM-LOW : 17 1.451 % 0.898 % > SPAM-MED : 152 12.969 % 8.030 % > WEIGHT5 : 717 61.177 % 37.876 % > Whitelisted : 340 29.010 % 17.961 % > ------------------------------------------------------------- > > Kevin Bilbee > Network Administrator > Standard Abrasives, Inc. > [EMAIL PROTECTED] > (805) 520-5800 x7332 > ____________________________________ > Changing the way industry works. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- Dieses E-Mail wurde von Declude.Virus auf Virusfreiheit geprueft Ein Service von interactiveaustria, http://www.iaa.at --- --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
