Single domains/entities will naturally have a much larger standard
deviation, especially if there is no protection from dictionary
attacks. Just one single spammer that hammers a particular domain
(dictionary attack or harvested addresses) can create a huge volume of
E-mail, and if they go on vacation, get arrested, or for some other
reason stops spamming your addresses, the difference can be remarkable.
It's hard to generate hard numbers for the increase in spam for our
service since we continually add customers and things can vary widely
between customers, but our spam percentage last year increased by 20%
(relative to volume). We currently see over 90% of volume as spam on
average, but much of that is now being blocked at the gateway in
address validation, and not every domain is yet being validated. It's
hard for me to pin down what the spam volume is on legitimate
addresses, but I'm confident that is is measurably lower, probably
around the 60% to 70% level across a wide variety of clients.
I haven't seen any notable changes in spam volume recently, and
wouldn't expect to either since our standard deviation is quite small
based on the variety of domains.
Matt
Colbeck, Andrew wrote:
My spam volume has increased every month since Jan 2003 when we started
tracking. What changes is the acceleration from month to month. Also,
the spammers took a break during each of the major virus outbreaks.
Andrew 8)
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Scott Fisher
Sent: Friday, April 01, 2005 8:47 AM
To: Declude.JunkMail@declude.com
Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
My spam numbers peaked in December and the total amount of spam has
declined
since.
Overall percentage went from 75% of all e-mail in December to 67% in
March.
----- Original Message -----
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Friday, April 01, 2005 10:09 AM
Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
Sorry Heinrich....<grin>
Maybe this is just payback for the sudden ~4x increase we saw last
fall...our levels have now dropped back to what they were prior to
mid-October.
Darin.
----- Original Message -----
From: "Heinrich Richter" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Friday, April 01, 2005 10:57 AM
Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
Hello Darin,
it seems that i got a lot of the mails you are missing ;-(
Our volume increased about 25% last month and the number of SPAM
increased about 64%. Our spam detection rate is about 98% and the
overall spamrate has incresed from 40% to 50% last month.
Heinrich
----- Original Message -----
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Friday, April 01, 2005 4:47 PM
Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
Just as a followup, I have confirmed that we have had a 15%+ drop in
incoming volume. If that is mostly spam, then that would indicate
almost a 20% drop in spam. If most of that is in our hold range
(about 40% of incoming spam ends up in our hold queue), then it could
account for half or
more of the drop in held spam.
Also, we're definitely seeing a significant increase in detection
rates for the tests listed below, so a lot less is ending up in our
hold queue, despite raising the delete limit.
Anyone else seeing a similar drop in incoming spam and an increase in
detection rates for the tests listed below?
Darin.
----- Original Message -----
From: "Darin Cox" <[EMAIL PROTECTED]>
To: <Declude.JunkMail@declude.com>
Sent: Thursday, March 31, 2005 10:56 AM
Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
You know, I think was misleading/inaccurate in how I said it. I
really meant accuracy, not detection rate. I was thinking detection
rate as the number
of messages detected as spam by the test that were actually spam, but
I
should have said accuracy. Sorry for the confusion...language is a
funny
thing...
These are the best tests we run, in terms of catching the most spam,
but they're not catching at the percentages below. There are others
that are highly accurate as well, but these catch the most volume.
My apologies again for the confusion.
Darin.
----- Original Message -----
From: "Pete McNeil" <[EMAIL PROTECTED]>
To: "Darin Cox" <Declude.JunkMail@declude.com>
Sent: Thursday, March 31, 2005 10:36 AM
Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote:
DC> That is very significant, and could explain what I'm seeing. I'm
going
to
DC> increase my delete weight a bit for a while to make sure there
DC> are no
high
DC> FPs.
DC> I do see the following detection rates from yesterday (3/30)
DC> AHBL 97.4%
DC> CBL 99.9%
DC> CSMA 97.1%
DC> CSMA-SBL 93.4%
DC> JAMMDNSBL 76.0%
DC> PSBL 96.9%
DC> SBL 99.5%
DC> SENDERDB-BL 96.4%
DC> SNIFFER 98.7%
DC> SPAMCOP 99.7%
DC> UCEPROTECT1 100%
DC> UCEPROTECT2 97.2%
DC> rates for all seem to have increased significantly over the past
couple
of
DC> days.
WOW! That's weird. I do not show that at all and I've never seen
those tests throw those kinds of numbers (except SNF looks about
right):
http://www.sortmonster.com/MDLP/MDLP-Example-Short.html
For example (a quick spot check) -
Data through last noon to midnight--
AHBL shows up at about 22% (21.8409)
SPAMCOP shows up at about 64% (63.5114)
UCEPROTECCMUL sows up at about 42% (41.6237)
UCEPROTECRDO shows up at about 48% (48.0324)
Long range data through last midnight--
AHBL shows up at about 16% (16.111)
SPAMCOP shows up at about 62% (62.3942)
UCEPROTECCMUL shows up at about 42% (41.7421)
UCEPROTECRDO shows up at about 49% (48.6102)
All in all these indicate nominal performance.
Most likely there is something special about the mix of spam you are
getting, something wrong with your reporting process, or something
else going on that we haven't thought of.
To be thorough I also checked some of the MDLP reports from other
systems that are beta testing it. With few exceptions they show
numbers similar to mine w/ regard to these tests.
If I were you I would not make any substantive changes until I
tracked down what was going on. No need to introduce additional
variables by changing things ;-)
DC> BTW, I sent to the Junkmail in part so others could comment on
DC> other tests that may have significantly changed.
It's all good :-)
_M
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---------------------------------------------------
This E-mail was scanned for viruses by CAD-FEM GmbH
---------------------------------------------------
This E-mail was scanned for viruses by CAD-FEM GmbH
*********************************************************************
This message and any attachment are confidential. If you are not the
intended recipient, please telephone or email the sender and delete
this message and any attachment from your system. If you are not the
intended recipient you must not copy this message or attachment or
disclose the contents to any other person.
For further information about CADFEM please see our website:
http://www.cadfem.de.
**********************************************************************
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
|
