The following is a list of tests that we run against the E-mails arriving at the spamtrap, and what percentage of the spam they caught (it may be easier to read if you use a fixed-width font):
WEIGHT10 99.53% WEIGHT20 96.79% SPAMCHK 96.50% SNIFFER 94.03% SPAMMANAGER 93.87% IPNOTINMX 83.79% WIREHUB-DNSBL 80.88% XBL 72.59% SPAMCOP 71.05% MAILDEFLECTOR 47.07% DSBLALL 44.80% DSBL 43.80% POSTFIXGATE 43.07% MONKEYPROXIES 39.62% FREEMAIL 35.03% NOPOSTMASTER 34.99% SPAMHAUS 34.71% REVDNS 33.52% OSSOFT 33.15% DORKZTL 32.17% SPAMHEADERS 31.24% BADHEADERS 31.06% BLITZEDALL 30.87% HELO 29.10% OSSRC 26.38% NOABUSE 23.83% BLARSBL 23.06% FIVETENDUL 22.29% INTERSIL 21.75% BADWHOIS 17.54% ROUTING 15.13% FIVETENSRC 14.24% OSPROXY 12.67% VOX 12.10% BASE64 9.71% IPWHOIS 9.51% FIVETENIGNORE 8.48% DSN 7.00% NJABL 6.89% SPAMBAG 6.81% DNSRBL-SPAM 6.59% OSRELAY 6.08% DELINK 5.94% FABELSOURCES 5.14% KUNDENSERVER 4.83% FIVETENOPTIN 4.73% ORDB 4.23% LNGSDUL 3.26% DNSRBL-DUN 2.91% NJABLDUL 2.46% DORKS 2.28% COMPU 2.21% WIREHUB-DYNA 2.02% MAILFROM 1.70% PIGS 1.58% OSDUL 1.49% COMMENTS 1.48% DSBLMULTI 1.37% FIVETENOTHER 0.97% KITHRUP 0.95% LNGSBLOCK 0.47% DEVNULL 0.33% FIVETENMULTI 0.30% NONENGLISH 0.28% ABL 0.28% JIPPG-DUL 0.23% DORKRELAYS 0.16% DEWS 0.12% FLOWGO 0.08% FIVETENWEBFORM 0.07% DNSMAILLIST 0.04% DNSUCE 0.02% LNGSSRC 0.02% CYBERSITTER 0.01% FIVETENSINGLE 0.01%
The WEIGHT10 and WEIGHT20 tests are a weighting system that assigns a weight to each E-mail, based on the spam tests that fail, so they don't really count as spam tests by themselves (but, they show that you can catch as much as 98-99% of spam with extremely few false positives). It is also important to note that different tests are more likely to produce false positives (such as the IPNOTINMX, XBL, REVDNS, and SPAMHEADERS tests, that all catch a lot of spam, but catch a lot of legitimate mail as well); those tests are best used in a weighting system, so E-mail will only be marked as spam if it fails a combination of tests.
Another interesting point is that about 1/3rd of all spam can be caught with the BADHEADERS test, which will not catch any legitimate E-mail (unless it is sent from a non-RFC-compliant mail client). That's because so many spammers forge headers, and because spamware is typically written by people who do not know how to program well.
There are 3 tests that catch over 90% of the spam in our spamtraps: SNIFFER ( http://www.sortmonster.com ) at 94.03%, CYBERSITTER ( http://www.spammanager.com ) at 93.87% (estimated due to a glitch on our mailserver), and SPAMCHK ( http://www.riedmann.it/spamchk/ ) at 96.50% (at its strictest setting; normally, a less strict setting would be used, to minimize false positives) .
More information on most of the various spam tests shown above can be found at http://www.declude.com/junkmail/support/ip4r.htm . You can look up an IP address using the Spam Database Lookup tool at http://www.DNSstuff.com to see what spam databases it is listed in. The most recent 20 spams in our spamtraps, and the tests they failed, can be found at http://www.declude.com/spamtrap.htm .
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no annual licensing fees.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
