Michelle Konzack wrote:
Hello Bill Landry,
Am 2011-03-18 15:11:47, hacktest Du folgendes herunter:
No wonder I have seen such a huge drop in spam the past few days:
??? I get 18-26 mio spams (36 servers with 96.000 users) per day and
nothing has changed. Please read the news (not only one) more carefully
http://timesofindia.indiatimes.com/tech/enterprise-it/security/Microsoft-brings-down-major-fake-drug-spam-network/articleshow/7734903.cms
Anyone else been noticing the decrease in spam?
No, because there are ore then one Botnet of this size now...
Absolutely yes.
Context:
- I run a bunch of medium sized, private, email lists on my servers, I'm
list admin for most, postmaster for all
- I've got a dozen or so personal email addresses, some of which date
back 30+ years (to ARPANET days)
- most of these addresses are highly visible
- I'm also on a ridiculous number of email lists
- all of my mail ultimately gets aggregated into one account, then
auto-sorted by a bunch of procmail rules
- I've got pretty much a stock postfix/spamassassin/clamav setup, with
rules kept up-to-date
- I don't run IP based blocklists - too many false positives
- I let spam through to my account, then use rule-based filters to send
mail with high scores to /dev/null, then use my eyeballs to delete
what's left (between avoiding false positives, and keeping track of spam
trends, the couple of minutes a day to do this seems worth it)
In this context, for the past year or so, I've been averaging 12,000 or
so emails per day arriving at my mailbox, of which they break down as
follows:
- 9000 or so to /dev/null
- 1000 or so bounce messages, server admin messages, and such - almost
all of which are either bounceback spam, or spam-related error messages
(e.g., the result of spam sent to list admin addresses)
- 1000 or so to a spam folder (high spam score, but not high enough to
send right to /dev/null) - easy to eyeball and delete, a couple of false
positives a week, sometimes a really important one (and sometimes a
really important one that I delete by accident)
- 500 or so messages from various email lists - mostly legitimate, most
of which I ignore for lack of time
- 500 or so messages that get to my general inbox - of which some are
for lists that I don't send to other folders, 50 or so legitmate
messages, and a good amount are spam that doesn't get caught anywhere else
As of two weeks ago, I saw a noticeable drop in the total number of
incoming messages per day - from 12,000 to around 8,000, and this has
stayed steady now. A drop of a third is definitely significant. My
sense is that this has mostly been in the category of things that went
directly to /dev/null. The amount of mail I manually eyeball does not
seem to have changed that much - though this is mostly a subjective
judgment, I haven't been tracking the statistics, other than noting them
in my daily log report.
One other datapoint: My outgoing mail que seems to have a lot fewer
messages that get stuck (the remaining spam that gets through all the
filters, that gets rejected remotely and requed).
--
In theory, there is no difference between theory and practice.
In<fnord> practice, there is. .... Yogi Berra
