Hello Roger, We have experienced a similar situation. Over the past week or so, more spam with easily identifiable spam characteristics has been getting past V8's anti-spam filters. In our situation, there are 2 reasons why:
V8's daily Postmaster reports have been very helpful for us to figure out our average daily mail volume (in and out, and the messages that are stopped by anti-spam filters). Over the past 2 months we get a daily average LocalDeliver of 2500 pieces of mail, 1000 pieces of mail RemoteDeliver, and about 400 pieces of mail filtered. About a week ago, our daily LocalDeliver jumped from 2500 pieces to 4700 pieces! Fortunately, our anti-spam filters had also doubled (to about 800). Obviously all of the additional 2300 pieces of mail that were delivered were spam. The number of messages stopped by the anti-spam filters did not increase proportionally with the number of LocalDeliver messages, but it was still working. Initially I thought that maybe some of our blacklists had stopped working, but the logs confirmed that everything was working correctly. So, it seems that our week-long barrage of spam is allowing a greater percentage of spam to slip through. So, it seems that while the spam filtering is not working as well as I would like, probably nothing has changed except for the exponential increase in spam being sent to us (I wish I knew why). Secondly, in an attempt to try to improve our content filtering I installed Ipswitch's updated phrase and statistics list. This made matters worse. I was never a fan of Ipswitch's phrase list, but the new phrase list is only 5K in size (?) and the previous phrase list was 26K. I presume that the content that was removed from the phrase list was stopping a lot of spam. Since I updated to Ipswitch's new phrase list, the mail being stopped by phrase filtering has dropped from 800 to 300. I'm considering restoring the previous phrase list. I must admit that our anti-spam solution is mostly 'hands-off' and I could do more to create a more intelligent phrase list, and I'd like to spend more time figuring out the IMail spam 'seeder' thingy. As a side note, even though our spam loads have increased, and yes it seems that mail with easily identifiable 'spam' characteristics is getting through, we have not seen an increase in the really nasty spam. Daniel > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:IMail_Forum- > [EMAIL PROTECTED] On Behalf Of Roger Meyers > Sent: Thursday, July 31, 2003 8:10 AM > To: [EMAIL PROTECTED] > Subject: [IMail Forum] IMail Server Antispam declining effectiveness? > > Good morning, > > I just joined the forum today - hopefully this isn't a tired old > question... > > I've been administrating version 8.0 of IMail Server for about 5 weeks. > Up > until about 2 weeks ago, spam detection was getting steadily better as I > built up an improved phrase list with wildcards and slowly tightened the > advanced settings. I've also cut down on the relatively rare false > positives using the white list. > > Recently I feel that the spam detection has been less effective. Users > are > receiving a higher volume of spam once again, and some of it plainly > includes words that are in my phrase filter list. There are also some > emails that are being marked as spam even though their domain, and even > specific email address, are in my white list. > > Has anyone else noticed this sort of behavior? > > ========================================== > Roger Meyers > Technical Support Analyst > Computer Trust Corporation > One State Street Suite 700 > Boston, MA 02109-3507 > Tel: 617-557-9264 x414 Fax: 617-557-9289 > ========================================== > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
