Scott, What is the NOLEGITCONTENT test?
Mike ----- Original Message ----- From: "R. Scott Perry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 01, 2003 11:11 AM Subject: [IMail Forum] September 2003 Spam Statistics > Each month, we go through our spamtraps (E-mail addresses designed to > collect spam), to find out which spam tests were most effective at catching > spam. The results this month are based on over 110,000 spams that were > received, all in September 2003. This represents more than a 30% increase > in spam over last month. In September 2003 we received over 10 times as > much spam as in September, 2002. Although several important spam tests > were recently forced to close by spammers, our stats show that spam can > still be caught effectively. > > The following is a list of tests that we run against the E-mails arriving > at the spamtraps, and what percentage of the spam they caught (it may be > easier to read if you use a fixed-width font): > > > WEIGHT10 99.61% > WEIGHT20 97.42% > NOLEGITCONTENT 96.41% > SPAMMANAGER 95.50% > SNIFFER 94.72% > SPAMCHK 93.17% > IPNOTINMX 90.25% > XBL 78.22% > SPAMCOP 75.06% > MAILDEFLECTOR 61.37% > EASYNET-DNSBL 55.72% > DSBLALL 47.88% > DSBL 47.19% > BADHEADERS 46.86% > BLARSBL 39.82% > FIVETENSRC 37.70% > EASYNET-PROXIES 35.97% > EASYNET-DYNA 34.49% > REVDNS 31.98% > EXPER 31.74% > FREEMAIL 31.51% > NJABLPROXIES 31.35% > NOPOSTMASTER 30.67% > HELO 29.71% > NOABUSE 28.83% > ROUTING 21.11% > RSL 19.61% > SPAMHAUS 18.85% > BLITZEDALL 14.85% > SPAMHEADERS 14.82% > COMMENTS 13.14% > BASE64 12.96% > IPWHOIS 10.60% > DSN 9.71% > COMPU 9.28% > DELINK 7.64% > NJABLSOURCES 6.71% > FABELSOURCES 5.10% > NJABLDUL 4.97% > INTERSIL 4.69% > SPAMBAG 4.06% > FIVETENIGNORE 3.72% > LNGSDUL 3.71% > BADWHOIS 3.01% > NJABL 2.80% > FIVETENOPTIN 2.46% > VOX 2.36% > ORDB 2.21% > MAILFROM 1.86% > KUNDENSERVER 1.60% > LNGSBLOCK 1.03% > PIGS 0.85% > DSBLMULTI 0.68% > DNSRBL-DUN 0.60% > JIPPG-DUL 0.53% > NONENGLISH 0.53% > DEVNULL 0.34% > KITHRUP 0.29% > FIVETENMULTI 0.07% > FIVETENOTHER 0.02% > DNSMAILLIST 0.01% > JIPPG-DULJP 0.01% > > > The WEIGHT10 and WEIGHT20 tests are a weighting system that assigns a > weight to each E-mail, based on the spam tests that fail, so they don't > really count as spam tests by themselves (but, they show that you can catch > as much as 97-99+% of spam with extremely few false positives). It is also > important to note that different tests are more likely to produce false > positives (such as the IPNOTINMX, XBL, REVDNS, and SPAMHEADERS tests, that > all catch a lot of spam, but catch a lot of legitimate mail as well); those > tests need to be used in a weighting system, so E-mail will only be marked > as spam if it fails a combination of tests. The NOLEGITCONTENT and > IPNOTINMX tests were designed to help identify legitimate E-mail (rather > than spam), which accounts for their high percentages. > > It is interesting to note that at least 46% of the spam in September could > safely be caught by the BADHEADERS test (since no RFC-compliant mail client > will send out E-mail that fails the BADHEADERS test). > > There are 3 spam tests that catch over 90% of the spam in our > spamtraps: SPAMMANAGER ( http://www.spammanager.com ), SNIFFER > http://www.sortmonster.com ), and SPAMCHK http://www.riedmann.it/spamchk/ > ) (at its strictest setting; normally, a less strict setting would be used, > to minimize false positives). > > More information on most of the spam tests shown above can be found at > http://www.declude.com/junkmail/support/ip4r.htm . You can look up an IP > address using the Spam Database Lookup tool at http://www.DNSstuff.com to > see what spam databases it is listed in. The most recent 20 spams in our > spamtraps, and the tests they failed, can be found at > http://www.declude.com/spamtrap.htm . > > -Scott > --- > Declude JunkMail: The advanced anti-spam solution for IMail mailservers. > Declude Virus: Catches known viruses and is the leader in mailserver > vulnerability detection. > Find out what you have been missing: Ask for a free 30-day evaluation. > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
