I use sorbs-http with a last hop and a all hop configuartion. For June, the -ALL hit on 48 non-spam e-mails the -LAST hit on 27 non-spam e-mails.
SORBS-HTTP-LAST dnsbl %IP4R%.dnsbl.sorbs.net 127.0.0.2 0 0 SORBS-HTTP-ALL ip4r dnsbl.sorbs.net 127.0.0.2 0 0 Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 06/30/04 01:41AM >>> I have some other numbers. For example SORBS-HTTP Yesterday it has had the correct result for 7% of the processed messages (776 of 11161 messages) But it has also had a positive (wrong) result for 17 legit messages. (so one of this messages was slightly above our hold treeshould => false positive) But SORBS-HTTP catches nearly all spam messages that has already failed enough other tests to be hold. So it's not really usefull to have ~ 759 correct votes from SORBS-HTTP for spam messages if they have already reached a weight above 200 % of the hold weight. On the other side it's problemtic if from the 17 legit messages catched by SORBS-HTTP 4 are near to or over the hold weight. My conclusion: SORBS-HTTP results will have no effect on the detection rate, it increases only to posibility to have some false positives. (The results will not change if I look for the last 2 or 4 weeks, and not only yesterday) Also I can see nearly the same results for SORBS-SPAM (positive result in 8% / 23 wrong results for legit messages / 6 legit messages near the hold weight / all other messages above 200% of the hold weight) Attached you can see a diagramm with the variation of the final weight for all yesterday messages failing SORBS-HTTP. A similar diagnosis could be made for several other tests. It's only a little bit of work and I don't know if someone counts on such reports... Markus _____ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sharyn Schmidt Sent: Monday, June 28, 2004 7:33 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Global configs Yesterday's summary: SORBS...............5,061.......47.70% SORBS-BADCONF..........22........0.21% SORBS-DUHL..........3,273.......30.85% SORBS-HTTP..........1,119.......10.55% SORBS-MISC............476........4.49% SORBS-SMTP.............79........0.74% SORBS-SOCKS.........1,157.......10.91% SORBS-WEB..............94........0.89% SORBS-ZOMBIE............8........0.08% Thanks! I'll take that as a YES! Sharyn --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
