[IMail Forum] January 2003 Spam Statistics

[R. Scott Perry]

In April, 2002, we started to go through our spamtraps (E-mail addresses designed to collect spam), to find out which spam tests were most effective at catching spam. The results this month are based on just about 20,000 spams that were received, all in January, 2003. In January, our spamtraps received about 10% more spam than December (which received 25% more spam than November). In January, 2003 we received more than 5 times as much spam as in January, 2002 (spam is definitely getting worse).

The following is a list of tests that we run against the E-mails arriving at the spamtrap, and what percentage of the spam they caught (it may be easier to read if you use a fixed-width font):


WEIGHT10 99.83%
WEIGHT20 98.10%
CYBERSITTER 97.18%
SNIFFER 89.62%
IPNOTINMX 80.42%
SPAMCOP 73.82%
WIREHUB-DNSBL 71.86%
XBL 65.47%
MAILDEFLECTOR 49.48%
SPAMHEADERS 38.49%
REVDNS 38.04%
SPAMHAUS 36.39%
DSBLALL 36.37%
DSBL 35.14%
FREEMAIL 32.64%
OSSOFT 32.04%
NOPOSTMASTER 30.31%
HELO 29.48%
INTERSIL 28.37%
OSSRC 28.23%
BADHEADERS 23.09%
BLITZEDALL 21.81%
DORKZTL 21.36%
NOABUSE 21.04%
MONKEYPROXIES 20.29%
FIVETENDUL 18.85%
BLITZEDHTTP 18.49%
BLARSBL 17.21%
BASE64 14.68%
OSPROXY 14.11%
FIVETENSRC 13.14%
IPWHOIS 11.88%
ROUTING 11.29%
DNSRBL-SPAM 10.74%
BADWHOIS 10.51%
NJABL 9.22%
VOX 8.52%
FABELSOURCES 7.80%
OSRELAY 7.25%
FIVETENIGNORE 6.86%
KUNDENSERVER 6.53%
BLITZEDSOCKS 6.51%
ORDB 5.87%
SPAMBAG 5.84%
FIVETENOPTIN 4.85%
DELINK 4.77%
DSN 3.85%
COMPU 3.51%
MAILFROM 2.97%
DORKS 2.55%
DNSRBL-DUN 2.22%
KITHRUP 2.09%
LNGSDUL 1.88%
NJABLDUL 1.61%
WIREHUB-DYNA 1.47%
DSBLMULTI 1.37%
OSDUL 0.87%
ABL 0.63%
DEVNULL 0.50%
PIGS 0.48%
MONKEYFORMMAIL 0.30%
BLITZEDWINGATE 0.26%
FIVETENMULTI 0.24%
DORKRELAYS 0.23%
LNGSBLOCK 0.19%
FLOWGO 0.17%
FIVETENOTHER 0.14%
FIVETENWEBFORM 0.13%
DNSMAILLIST 0.04%
JIPPG-DUL 0.03%
JIPPG-DULJP 0.01%
DNSUCE 0.01%


The WEIGHT10 and WEIGHT20 tests are a weighting system that assigns a weight to each E-mail, based on the spam tests that fail, so they don't really count as spam tests by themselves (but, they show that you can catch as much as 98-99% of spam with extremely few false positives). It is also important to note that different tests are more likely to produce false positives (such as the IPNOTINMX, XBL, REVDNS, and SPAMHEADERS tests, that all catch a lot of spam, but catch a lot of legitimate mail); those tests are best used in a weighting system, so E-mail will only be marked as spam if it fails a combination of tests.

The four best tests are CYBERSITTER (in beta; http://www.spammanager.com ) at 97.18%, SNIFFER ( http://www.sortmonster.com ) at 89.62%, SPAMCOP ( http://www.spamcop.net ) at 73.82%, and WIREHUB-DNSBL ( http://basic.wirehub.nl/blackholes.html ) at 71.86%. Although all 4 can produce some false positives (we hope to have information on false positive ratios in the February, 2003 update), using weights can minimize the chances of false positives.

More information on most of the various spam tests shown above can be found at http://www.declude.com/junkmail/support/ip4r.htm . You can look up an IP address using the Spam Database Lookup tool at http://www.DNSstuff.com to see what spam databases it is listed in. The most recent 20 spams in our spamtraps, and the tests they failed, can be found at http://www.declude.com/spamtrap.htm .

-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for IMail. http://www.declude.com

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]


To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/