Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail was scanned for viruses by CAD-FEM GmbH --- This E-mail was scanned for viruses by CAD-FEM GmbH * This message and any attachment are confidential. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system. If you are not the intended recipient you must not copy
Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
Sorry Heinrichgrin Maybe this is just payback for the sudden ~4x increase we saw last fall...our levels have now dropped back to what they were prior to mid-October. Darin. - Original Message - From: Heinrich Richter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:57 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com
RE: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
Heinrich, How are you determining your detection rates? Are you using a combination of certain tests or overall test percentages? Thanks for the time. Keith -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Heinrich Richter Sent: Friday, April 01, 2005 10:57 AM To: Declude.JunkMail@declude.com Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail
Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
My spam numbers peaked in December and the total amount of spam has declined since. Overall percentage went from 75% of all e-mail in December to 67% in March. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:09 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Sorry Heinrichgrin Maybe this is just payback for the sudden ~4x increase we saw last fall...our levels have now dropped back to what they were prior to mid-October. Darin. - Original Message - From: Heinrich Richter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:57 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com
RE: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
My spam volume has increased every month since Jan 2003 when we started tracking. What changes is the acceleration from month to month. Also, the spammers took a break during each of the major virus outbreaks. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, April 01, 2005 8:47 AM To: Declude.JunkMail@declude.com Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue My spam numbers peaked in December and the total amount of spam has declined since. Overall percentage went from 75% of all e-mail in December to 67% in March. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:09 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Sorry Heinrichgrin Maybe this is just payback for the sudden ~4x increase we saw last fall...our levels have now dropped back to what they were prior to mid-October. Darin. - Original Message - From: Heinrich Richter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:57 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there DC are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta
Re: [Declude.JunkMail] Huge reduction in hold queue
Single domains/entities will naturally have a much larger standard deviation, especially if there is no protection from dictionary attacks. Just one single spammer that hammers a particular domain (dictionary attack or harvested addresses) can create a huge volume of E-mail, and if they go on vacation, get arrested, or for some other reason stops spamming your addresses, the difference can be remarkable. It's hard to generate hard numbers for the increase in spam for our service since we continually add customers and things can vary widely between customers, but our spam percentage last year increased by 20% (relative to volume). We currently see over 90% of volume as spam on average, but much of that is now being blocked at the gateway in address validation, and not every domain is yet being validated. It's hard for me to pin down what the spam volume is on legitimate addresses, but I'm confident that is is measurably lower, probably around the 60% to 70% level across a wide variety of clients. I haven't seen any notable changes in spam volume recently, and wouldn't expect to either since our standard deviation is quite small based on the variety of domains. Matt Colbeck, Andrew wrote: My spam volume has increased every month since Jan 2003 when we started tracking. What changes is the acceleration from month to month. Also, the spammers took a break during each of the major virus outbreaks. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott Fisher Sent: Friday, April 01, 2005 8:47 AM To: Declude.JunkMail@declude.com Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue My spam numbers peaked in December and the total amount of spam has declined since. Overall percentage went from 75% of all e-mail in December to 67% in March. - Original Message - From: "Darin Cox" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:09 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Sorry Heinrichgrin Maybe this is just payback for the sudden ~4x increase we saw last fall...our levels have now dropped back to what they were prior to mid-October. Darin. - Original Message - From: "Heinrich Richter" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:57 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich - Original Message - From: "Darin Cox" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: "Darin Cox" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: "Pete McNeil" [EMAIL PROTECTED] To: "Darin Cox" Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there DC are no
RE: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
This is also my experience. Spam has dropped off radically since December. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Friday, April 01, 2005 11:47 AM To: Declude.JunkMail@declude.com Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue My spam numbers peaked in December and the total amount of spam has declined since. Overall percentage went from 75% of all e-mail in December to 67% in March. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:09 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Sorry Heinrichgrin Maybe this is just payback for the sudden ~4x increase we saw last fall...our levels have now dropped back to what they were prior to mid-October. Darin. - Original Message - From: Heinrich Richter [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:57 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: Darin Cox [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I
Re: [Declude.JunkMail] Huge reduction in hold queue
We're a hosting company, though a small one, so our statistics shouldn't fluctuate this much. Dictionary attacks is a distinct possibility. We had noticed that the spool directory has been much slimmer this week as well, and that is a main cause of spool directory bloating. Our spam volume had beenmarginally increasingfrom 80% last fall to around 85% last week, but now has probably dropped to around 50%. Only part of this was related to spam volume, though. The issue of detection rates bysome of the majortests was also something I was curious about others' experience with. Obviously there's a spike in Sniffer effectiveness, so overlap with other tests has probably pushed most of our hold queue over the delete weight, but it seemed that some other tests might also have seen a jump in effectiveness. So many possibilities...I guess we'll just be grateful for the respite until the next wave come...grin Darin. - Original Message - From: Matt To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 12:54 PM Subject: Re: [Declude.JunkMail] Huge reduction in hold queue Single domains/entities will naturally have a much larger standard deviation, especially if there is no protection from dictionary attacks. Just one single spammer that hammers a particular domain (dictionary attack or harvested addresses) can create a huge volume of E-mail, and if they go on vacation, get arrested, or for some other reason stops spamming your addresses, the difference can be remarkable.It's hard to generate hard numbers for the increase in spam for our service since we continually add customers and things can vary widely between customers, but our spam percentage last year increased by 20% (relative to volume). We currently see over 90% of volume as spam on average, but much of that is now being blocked at the gateway in address validation, and not every domain is yet being validated. It's hard for me to pin down what the spam volume is on legitimate addresses, but I'm confident that is is measurably lower, probably around the 60% to 70% level across a wide variety of clients.I haven't seen any notable changes in spam volume recently, and wouldn't expect to either since our standard deviation is quite small based on the variety of domains.MattColbeck, Andrew wrote: My spam volume has increased every month since Jan 2003 when we started tracking. What changes is the acceleration from month to month. Also, the spammers took a break during each of the major virus outbreaks. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Scott Fisher Sent: Friday, April 01, 2005 8:47 AM To: Declude.JunkMail@declude.com Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue My spam numbers peaked in December and the total amount of spam has declined since. Overall percentage went from 75% of all e-mail in December to 67% in March. - Original Message - From: "Darin Cox" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:09 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Sorry Heinrichgrin Maybe this is just payback for the sudden ~4x increase we saw last fall...our levels have now dropped back to what they were prior to mid-October. Darin. - Original Message - From: "Heinrich Richter" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 10:57 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Hello Darin, it seems that i got a lot of the mails you are missing ;-( Our volume increased about 25% last month and the number of SPAM increased about 64%. Our spam detection rate is about 98% and the overall spamrate has incresed from 40% to 50% last month. Heinrich - Original Message - From: "Darin Cox" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Friday, April 01, 2005 4:47 PM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue Just as a followup, I have confirmed that we have had a 15%+ drop in incoming volume. If that is mostly spam, then that would indicate almost a 20% drop in spam. If most of that is in our hold range (about 40% of incoming spam ends up in our hold queue), then it could account for half or more of the drop in held spam. Also, we're definitely seeing a significant increase in detection rates for the tests listed below, so a lot less is ending up in our hold queue, despite raising the delete limit. Anyone else seeing a similar drop in incoming spam and an increase in detection rates for the tests listed below? Darin. - Original Message - From: "Darin Cox" [EMAIL PROTECTED] To: Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:56 AM Subject: Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue You know, I think
Re: [Declude.JunkMail] Huge reduction in hold queue
On Wednesday, March 30, 2005, 10:35:52 PM, Darin wrote: DC Pete, DC DC Have you make significant changes to the sniffer rulebase in the past couple of days? DC DC I'm seeing a _huge_ reduction in hold queue messages... DC roughly down 65%... while total message volume is steady. Only DC thing I can figure is that the rulebase is suddenly identifying DC most of the messages that fail other tests as well, pushing most DC over the delete limit or other tests like SpamCop, DC Mailpolice, etc. have made significant changes... I've checked a DC few sites for news, but am not seeing anything new. DC DC The sudden change has me a wee bit concerned...cautiously optimistic, but concerned. THis might be better asked on the Sniffer forum rather than Declude's though I'm sure they don't mind. The only thing I can think of is that there has been a greater use of message fragment rules over the past few days in response to some of the newer campaigns. I wouldn't call that a radical change - but it has been a moderately heavy shift. In particular there is a new snake oil campaign that is using a number of randomized obfuscated segments in their message and we've been capitalizing on that. I don't see any significant shifts in the statistics. What I do see is a subtle change in the shape of the new rule capture curve (see the left side of this chart): http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp I have also seen higher spam rates and SNF capture rates in recent MDLP data on our system: http://www.sortmonster.com/MDLP/MDLP-Example-Short.html What counts in cases like these are false positive rates... If it seems that we're catching a lot more spam then lets be sure it really is spam. So far FP rates are nominal though there is a spike yesterday in the number (this appears to be an automated system that submits FPs from users -- the batch contains a larger than usual number of duplicate submissions -- this happens from time to time with this customer). http://www.sortmonster.com/MessageSniffer/Performance/FalseReportsRates.jsp Hope this helps, _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Huge reduction in hold queue
That is very significant, and could explain what I'm seeing. I'm going to increase my delete weight a bit for a while to make sure there are no high FPs. I do see the following detection rates from yesterday (3/30) AHBL 97.4% CBL 99.9% CSMA 97.1% CSMA-SBL 93.4% JAMMDNSBL 76.0% PSBL 96.9% SBL 99.5% SENDERDB-BL 96.4% SNIFFER 98.7% SPAMCOP 99.7% UCEPROTECT1 100% UCEPROTECT2 97.2% rates for all seem to have increased significantly over the past couple of days. BTW, I sent to the Junkmail in part so others could comment on other tests that may have significantly changed. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 8:09 AM Subject: Re: [Declude.JunkMail] Huge reduction in hold queue On Wednesday, March 30, 2005, 10:35:52 PM, Darin wrote: DC Pete, DC DC Have you make significant changes to the sniffer rulebase in the past couple of days? DC DC I'm seeing a _huge_ reduction in hold queue messages... DC roughly down 65%... while total message volume is steady. Only DC thing I can figure is that the rulebase is suddenly identifying DC most of the messages that fail other tests as well, pushing most DC over the delete limit or other tests like SpamCop, DC Mailpolice, etc. have made significant changes... I've checked a DC few sites for news, but am not seeing anything new. DC DC The sudden change has me a wee bit concerned...cautiously optimistic, but concerned. THis might be better asked on the Sniffer forum rather than Declude's though I'm sure they don't mind. The only thing I can think of is that there has been a greater use of message fragment rules over the past few days in response to some of the newer campaigns. I wouldn't call that a radical change - but it has been a moderately heavy shift. In particular there is a new snake oil campaign that is using a number of randomized obfuscated segments in their message and we've been capitalizing on that. I don't see any significant shifts in the statistics. What I do see is a subtle change in the shape of the new rule capture curve (see the left side of this chart): http://www.sortmonster.com/MessageSniffer/Performance/ChangeRates.jsp I have also seen higher spam rates and SNF capture rates in recent MDLP data on our system: http://www.sortmonster.com/MDLP/MDLP-Example-Short.html What counts in cases like these are false positive rates... If it seems that we're catching a lot more spam then lets be sure it really is spam. So far FP rates are nominal though there is a spike yesterday in the number (this appears to be an automated system that submits FPs from users -- the batch contains a larger than usual number of duplicate submissions -- this happens from time to time with this customer). http://www.sortmonster.com/MessageSniffer/Performance/FalseReportsRates.jsp Hope this helps, _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Huge reduction in hold queue
On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] Huge reduction in hold queue
You know, I think was misleading/inaccurate in how I said it. I really meant accuracy, not detection rate. I was thinking detection rate as the number of messages detected as spam by the test that were actually spam, but I should have said accuracy. Sorry for the confusion...language is a funny thing... These are the best tests we run, in terms of catching the most spam, but they're not catching at the percentages below. There are others that are highly accurate as well, but these catch the most volume. My apologies again for the confusion. Darin. - Original Message - From: Pete McNeil [EMAIL PROTECTED] To: Darin Cox Declude.JunkMail@declude.com Sent: Thursday, March 31, 2005 10:36 AM Subject: Re[2]: [Declude.JunkMail] Huge reduction in hold queue On Thursday, March 31, 2005, 9:50:05 AM, Darin wrote: DC That is very significant, and could explain what I'm seeing. I'm going to DC increase my delete weight a bit for a while to make sure there are no high DC FPs. DC I do see the following detection rates from yesterday (3/30) DC AHBL 97.4% DC CBL 99.9% DC CSMA 97.1% DC CSMA-SBL 93.4% DC JAMMDNSBL 76.0% DC PSBL 96.9% DC SBL 99.5% DC SENDERDB-BL 96.4% DC SNIFFER 98.7% DC SPAMCOP 99.7% DC UCEPROTECT1 100% DC UCEPROTECT2 97.2% DC rates for all seem to have increased significantly over the past couple of DC days. WOW! That's weird. I do not show that at all and I've never seen those tests throw those kinds of numbers (except SNF looks about right): http://www.sortmonster.com/MDLP/MDLP-Example-Short.html For example (a quick spot check) - Data through last noon to midnight-- AHBL shows up at about 22% (21.8409) SPAMCOP shows up at about 64% (63.5114) UCEPROTECCMUL sows up at about 42% (41.6237) UCEPROTECRDO shows up at about 48% (48.0324) Long range data through last midnight-- AHBL shows up at about 16% (16.111) SPAMCOP shows up at about 62% (62.3942) UCEPROTECCMUL shows up at about 42% (41.7421) UCEPROTECRDO shows up at about 49% (48.6102) All in all these indicate nominal performance. Most likely there is something special about the mix of spam you are getting, something wrong with your reporting process, or something else going on that we haven't thought of. To be thorough I also checked some of the MDLP reports from other systems that are beta testing it. With few exceptions they show numbers similar to mine w/ regard to these tests. If I were you I would not make any substantive changes until I tracked down what was going on. No need to introduce additional variables by changing things ;-) DC BTW, I sent to the Junkmail in part so others could comment on DC other tests that may have significantly changed. It's all good :-) _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Huge reduction in hold queue
Pete, Haveyou makesignificant changes to the sniffer rulebase in the past couple of days? I'm seeing a _huge_ reduction in hold queue messages... roughly down 65%...while total message volume is steady. Only thing I can figure is that the rulebase is suddenly identifying most of the messages that fail other tests as well, pushing most over the delete limit or other tests like SpamCop, Mailpolice, etc.have made significant changes... I've checked a few sites for news, but am not seeing anything new. The sudden change has me a wee bit concerned...cautiously optimistic, but concerned. Darin.
