Aaron Wolfe wrote: > +1 for the invaluement lists. they are excellent, sad that they > aren't listed in that comparison. we seem to get better results with > barracuda than you've seen, many of our clients choose to use the > barracuda list to block. we offer the hostkarma lists as well but > probably introduced them too soon, the FPs were high back when we > first offered it and most clients chose to score only if they use them > at all. I am going to re-evaluate though, and maybe recommend to some > clients. I have heard that the FP rate has improved.
The main reason ivmSIP is not in Jeff Makey's comparision chart is the same reason it is not in Al Iverson's (not yet repaired) charts. That is--ivmSIP doesn't try to win the "most spam caught" game. Instead, it seeks to catch the spams the other sender-IP dnsbls are missing, while striving to attain FP levels (at least) as low as those of Zen and SpamCop. At the least, ivmSIP strives to have fewer FPs than psbl, uceprotect-1, hostkarma, BRBL, njabl, sorbs --and fewer FPs means the ability to either score higher with ivmSIP, or outright block spams with ivmSIP. ivmSIP is also particularly good at catching snowshoe spams--and catches a significant amount of those and other spams missed by ALL of the other lists. But start measuring ivmSIP's "raw" hit rates against these others and ivmSIP doesn't look so hot anymore. This would, therefore, give an undeservedly bad impression if ivmSIP were on those charts--where "unique hits" and FPs are not taken into account (or not emphasized) In contrast, HostKarma does a great job of listing a *large* number of botnet IPs, many of which are often not yet listed on CBL/Zen. And Marc is doing a great job of reporting zombie IPs to various ISPs--which is helping to close down zombies--which then helps EVERYONE. Plus, unlike the invaluement lists, the hostkarma lists are freely available for direct query (for those serving <= 1000 email accounts AND making <250,000 DNS queries per day --OR-- free for those who participating in sending him data... contact Marc for more details on that!) Because of the different goals/strengths/weaknesses, anyone using ivmSIP and ivmSIP/24 could still benefit from HostKarma and these other lists, and vice versa. The key is gaging each list's score based on that list's ability to avoid FPs--combined with one's tolerance for FPs. For example, in my own spam filtering, I recently started seeing far too many FPs where legit hand-typed messages were hit on by two of the DNSBLs I mentioned above (not talking about hostkarma, btw). I had each of them scoring "below threshold"--but both together had a score that was just above threshold and this was causing legit mail to go into spam folders. That inspired me to back off of those two DNSBLs by one point each. But, even with their lowered score, I still find each of those two lists very helpful for putting many spams just over the top in their scoring, thus reducing spam to my users, but without causing FPs. -- Rob McEwen http://dnsbl.invaluement.com/ r...@invaluement.com +1 (478) 475-9032
