In version 8.0 the phrase list contained many domains since 8.0 did not have a URL domain reject list. With the release of 8.01 the domains were moved from the phrase filter to the URL black list so the phrase file is smaller now.
Tripp ----- Original Message ----- From: "Daniel Armstrong" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 31, 2003 11:24 AM Subject: RE: [IMail Forum] IMail Server Antispam declining effectiveness? > Hello Roger, > > We have experienced a similar situation. Over the past week or so, more > spam with easily identifiable spam characteristics has been getting past > V8's anti-spam filters. In our situation, there are 2 reasons why: > > V8's daily Postmaster reports have been very helpful for us to figure > out our average daily mail volume (in and out, and the messages that are > stopped by anti-spam filters). Over the past 2 months we get a daily > average LocalDeliver of 2500 pieces of mail, 1000 pieces of mail > RemoteDeliver, and about 400 pieces of mail filtered. > > About a week ago, our daily LocalDeliver jumped from 2500 pieces to 4700 > pieces! Fortunately, our anti-spam filters had also doubled (to about > 800). Obviously all of the additional 2300 pieces of mail that were > delivered were spam. > > The number of messages stopped by the anti-spam filters did not increase > proportionally with the number of LocalDeliver messages, but it was > still working. Initially I thought that maybe some of our blacklists had > stopped working, but the logs confirmed that everything was working > correctly. So, it seems that our week-long barrage of spam is allowing a > greater percentage of spam to slip through. > > So, it seems that while the spam filtering is not working as well as I > would like, probably nothing has changed except for the exponential > increase in spam being sent to us (I wish I knew why). > > Secondly, in an attempt to try to improve our content filtering I > installed Ipswitch's updated phrase and statistics list. This made > matters worse. I was never a fan of Ipswitch's phrase list, but the new > phrase list is only 5K in size (?) and the previous phrase list was 26K. > I presume that the content that was removed from the phrase list was > stopping a lot of spam. Since I updated to Ipswitch's new phrase list, > the mail being stopped by phrase filtering has dropped from 800 to 300. > I'm considering restoring the previous phrase list. > > I must admit that our anti-spam solution is mostly 'hands-off' and I > could do more to create a more intelligent phrase list, and I'd like to > spend more time figuring out the IMail spam 'seeder' thingy. > > As a side note, even though our spam loads have increased, and yes it > seems that mail with easily identifiable 'spam' characteristics is > getting through, we have not seen an increase in the really nasty spam. > > Daniel > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:IMail_Forum- > > [EMAIL PROTECTED] On Behalf Of Roger Meyers > > Sent: Thursday, July 31, 2003 8:10 AM > > To: [EMAIL PROTECTED] > > Subject: [IMail Forum] IMail Server Antispam declining effectiveness? > > > > Good morning, > > > > I just joined the forum today - hopefully this isn't a tired old > > question... > > > > I've been administrating version 8.0 of IMail Server for about 5 > weeks. > > Up > > until about 2 weeks ago, spam detection was getting steadily better as > I > > built up an improved phrase list with wildcards and slowly tightened > the > > advanced settings. I've also cut down on the relatively rare false > > positives using the white list. > > > > Recently I feel that the spam detection has been less effective. > Users > > are > > receiving a higher volume of spam once again, and some of it plainly > > includes words that are in my phrase filter list. There are also some > > emails that are being marked as spam even though their domain, and > even > > specific email address, are in my white list. > > > > Has anyone else noticed this sort of behavior? > > > > ========================================== > > Roger Meyers > > Technical Support Analyst > > Computer Trust Corporation > > One State Street Suite 700 > > Boston, MA 02109-3507 > > Tel: 617-557-9264 x414 Fax: 617-557-9289 > > ========================================== > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
