We're a hosting company, though a small one, so our
statistics shouldn't fluctuate this much.
Dictionary attacks is a distinct possibility.
We had noticed that the spool directory has been much slimmer this week as well,
and that is a main cause of spool directory bloating.
Our spam volume had been marginally
increasing from 80% last fall to around 85% last week, but now has probably
dropped to around 50%.
Only part of this was related to spam volume,
though. The issue of detection rates by some of the major tests
was also something I was curious about others' experience with. Obviously
there's a spike in Sniffer effectiveness, so overlap with other tests has
probably pushed most of our hold queue over the delete weight, but it seemed
that some other tests might also have seen a jump in effectiveness.
So many possibilities...I guess we'll just be
grateful for the respite until the next wave come...<grin>
Darin.
----- Original Message -----
From: Matt
Sent: Friday, April 01, 2005 12:54 PM
Subject: Re: [Declude.JunkMail] Huge reduction in hold
queue It's hard to generate hard numbers for the increase in spam for our service since we continually add customers and things can vary widely between customers, but our spam percentage last year increased by 20% (relative to volume). We currently see over 90% of volume as spam on average, but much of that is now being blocked at the gateway in address validation, and not every domain is yet being validated. It's hard for me to pin down what the spam volume is on legitimate addresses, but I'm confident that is is measurably lower, probably around the 60% to 70% level across a wide variety of clients. I haven't seen any notable changes in spam volume recently, and wouldn't expect to either since our standard deviation is quite small based on the variety of domains. Matt Colbeck, Andrew wrote: My spam volume has increased every month since Jan 2003 when we started tracking. What changes is the acceleration from month to month. Also, the spammers took a break during each of the major virus outbreaks. Andrew 8) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott Fisher Sent: Friday, April 01, 2005 8:47 AM To: Declude.JunkMail@declude.com Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue My spam numbers peaked in December and the total amount of spam has declined since. Overall percentage went from 75% of all e-mail in December to 67% in March. ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Friday, April 01, 2005 10:09 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queueSorry Heinrich....<grin> Maybe this is just payback for the sudden ~4x increase we saw last fall...our levels have now dropped back to what they were prior to mid-October. Darin. ----- Original Message ----- From: "Heinrich Richter" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Friday, April 01, 2005 10:57 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queueJust as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it couldaccount for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase indetection rates for the tests listed below? Darin. ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, butIshould have said accuracy. Sorry for the confusion...language is afunnything... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. ----- Original Message ----- From: "Pete McNeil" <[EMAIL PROTECTED]> To: "Darin Cox" <Declude.JunkMail@declude.com> Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC> That is very significant, and could explain what I'm seeing. I'm going to DC> increase my delete weight a bit for a while to make sure there DC> are no high DC> FPs. DC> I do see the following detection rates from yesterday (3/30) DC> AHBL 97.4% DC> CBL 99.9% DC> CSMA 97.1% DC> CSMA-SBL 93.4% DC> JAMMDNSBL 76.0% DC> PSBL 96.9% DC> SBL 99.5% DC> SENDERDB-BL 96.4% DC> SNIFFER 98.7% DC> SPAMCOP 99.7% DC> UCEPROTECT1 100% DC> UCEPROTECT2 97.2% DC> rates for all seem to have increased significantly over the past couple of DC> days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC> BTW, I sent to the Junkmail in part so others could comment on DC> other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --------------------------------------------------- This E-mail was scanned for viruses by CAD-FEM GmbH--------------------------------------------------- This E-mail was scanned for viruses by CAD-FEM GmbH ********************************************************************* This message and any attachment are confidential. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person. For further information about CADFEM please see our website: http://www.cadfem.de. ********************************************************************** --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ ===================================================== |
- Re: [Declude.JunkMail] Huge reduction in hold queue Darin Cox
- [Declude.JunkMail] Declude Update [EMAIL PROTECTED]