Declining effectiveness of blocklists, Almost all spam is caught by SpamAssasin Options

[mshalperin]

I set my Spamcop Email filters with all available blocklists activated and SpamAssassin threshold at 3. With this very little spam escapes into my Inbox and even less legitimate mail is held. However, over the last year or so, the percentage of spam picked up by the blocklists has steadily declined from 50-60% to now only 5-10%. Also, of those filtered by blockists, less that half are by the Spamcop bl (I assume that the Spamcop bl is the first one applied). My total spam volume has increased. Most of my mail is sent directly to my Spamcop address, with the rest forwarded from Yahoo (filtering off), Road Runner (no known filtering) and Hotmail (no filtering). Unless there is some silent upstream bl filtering, before getting to Spamcop email, and my true spam volume is much higher than I see, it would appear that the spammers are effectively defeating the Spamcop bl (and others). If the primary (really only) value of reporting spam to Spamcop is to support their bl, what is it now accomplishing?

[Jeff G.]

Please see the recent discussions of the ineffectiveness of the country blocklists for SpamCop Email System Customers at Brazil blocking off air and Are Country blacklists working?. Thanks!

[mshalperin]

Please see the recent discussions of the ineffectiveness of the country blocklists for SpamCop Email System Customers at Brazil blocking off air and Are Country blacklists working?.  Thanks!

Thanks. The first "discussion" was more of a flame-fest and got quickly too tired of the trading insults and minimally intelligible or informative posts to want to finish the thread. Neither thread discussed the minimal current effectiveness of the Spamcop bl itself. The country specific bl's aren't supported by Spamcop reporting. My point is - why bother reporting spam to Spamcop if the bl it produces is nearly useless.

[Jeff G.]

My point is - why bother reporting spam to Spamcop if the bl it produces is nearly useless.

It's not nearly useless to me, it catches most of my spam. Perhaps your spammers are a little more efficient at finding heretofore-unreported open proxies and zombies than mine are. If so, I'm sorry to hear that, but that makes it even more important for you to Report than it is for me to Report.

[mshalperin]

It's not nearly useless to me, it catches most of my spam.  Perhaps your spammers are a little more efficient at finding heretofore-unreported open proxies and zombies than mine are.  If so, I'm sorry to hear that, but that makes it even more important for you to Report than it is for me to Report.

I report as quickly as I can - 2-3hr average report time. Maybe my spammers are more clever, but I see the same source domains over and over agailn without being picked up on the bl. How many reports does it take?

[turetzsr]

Hi!

<snip>
How many reports does it take?

...Please check the link in Pinned: Original SpamCop FAQ Plus - Read before Posting labeled What is on the list? under "SpamCop Blocking List Service" and let us know if that answers your question. Thanks!

[StevenUnderwood]

I set my Spamcop Email filters with all available blocklists activated and SpamAssassin threshold at 3.  With this very little spam escapes into my Inbox and even less legitimate mail is held.  However, over the last year or so, the percentage of spam picked up by the blocklists has steadily declined from 50-60% to now only 5-10%.

Be aware that recently (last month or so), the spamcop email system appears to have changed the order the blocklists are applied with SpamAssassin being checked first and not going any further processing if it is high enough to block. If you check the IP addresses against the various blocklists, most of the time they are listed there as well. I think it was just more efficient to use the local SA settings first then start using network resources to check against the BL's.

My overall false negative (spam getting through) rate has not changed at all.

[mshalperin]

Hi!...Please check the link in Pinned: Original SpamCop FAQ Plus - Read before Posting labeled What is on the list? under "SpamCop Blocking List Service" and let us know if that answers your question. Thanks!

Thanks! I've already read that. I was questioning why 95+% of my spam was being trapped by Spamassassin instead of the BL - including the same spam from the same sources that I have repeatedly reported.

[mshalperin]

Be aware that recently (last month or so), the spamcop email system appears to have changed the order the blocklists are applied with SpamAssassin being checked first and not going any further processing if it is high enough to block.  If you check the IP addresses against the various blocklists, most of the time they are listed there as well.  I think it was just more efficient to use the local SA settings first then start using network resources to check against the BL's.

My overall false negative (spam getting through) rate has not changed at all.

Thanks for the update. That would explain the big shift to SpamAssasin as the listed trapping agent. I also haven't seen any significant change in false negative or false positive rates. It would seem that SpamAssassin is very efficient and accurate.

[turetzsr]

Hi!...Please check the link in Pinned: Original SpamCop FAQ Plus - Read before Posting labeled What is on the list? under "SpamCop Blocking List Service" and let us know if that answers your question. Thanks!

Thanks! I've already read that. I was questioning why 95+% of my spam was being trapped by Spamassassin instead of the BL - including the same spam from the same sources that I have repeatedly reported.

...Hmm ... perhaps I'm confused, but in the post to which I've replied, it doesn't appear so. Here is the exact quote to which I was replying:

I report as quickly as I can - 2-3hr average report time.  Maybe my spammers are more clever, but I see the same source domains over and over agailn without being picked up on the bl.  How many reports does it take?

[Wazoo]

Thanks.  The first "discussion" was more of a flame-fest and got quickly too tired of the trading insults and minimally intelligible or informative posts to want to finish the thread.  Neither thread discussed the minimal current effectiveness of the Spamcop bl itself.  The country specific bl's aren't supported by Spamcop reporting.  My point is - why bother reporting spam to Spamcop if the bl it produces is nearly useless.

You've a bit of a strange definition of "flamefest and insult trading" in my opinion. Had you actually read the same thing I just re-read, you'd see that you are repeating the same thing 'here' ... no specific data to support what you are claiming to be a problem. Maybe 90% of the "first topic referenced" is specifically about getting some specific sample data provided so there'd be something to look at beyond "it's broke" ....

[btech]

I'm no spam specialist, but doesn't that just mean that new infected computers are being used OR that new sets of IP addresses are infected/zombied?

I wouldn't call that a failure on the BLs, but rather an issue with the computer users of the planet.

[mshalperin]

I'm no spam specialist, but doesn't that just mean that new infected computers are being used OR that new sets of IP addresses are infected/zombied?

I wouldn't call that a failure on the BLs, but rather an issue with the computer users of the planet.

I'm not sure what you're getting at, but if spammers are able to circumvent the BL with aggressive "zombification", they have succeeded in making it useless regardless of whose "fault" it is... Actually, Steven Underwood may have explained this with the changed order of spam filtering- now using SpamAssassin first and only applying the BL to those that pass it. This saves system resources (but only if the majority of email is spam caught by SpamAssasin).

[Jeff G.]

now using SpamAssassin first and only applying the BL to those that pass it.  This saves system resources (but only if the majority of email is spam caught by SpamAssasin).

To the contrary, this saves system resources no matter what fraction of messages are caught by SpamAssassin.

[mshalperin]

You've a bit of a strange definition of "flamefest and insult trading" in my opinion.  Had you actually read the same thing I just re-read, you'd see that you are repeating the same thing 'here' ... no specific data to support what you are claiming to be a problem.  Maybe 90% of the "first topic referenced" is specifically about getting some specific sample data provided so there'd be something to look at beyond "it's broke" ....

The tone of your post just proves my point. Most of the "first topic referenced" consisted of you lambasting the writers for not adequately documenting the problems to your satisfaction, and their angry responses to your clear hostility. You really need to learn from your colleagues how to communicate diplomatically. My posts "here" were very specific and not vague whining and ranting that "it's broke". If you really require absolute documentation, I'll be glad to post as many days. weeks, months of spam in my Held Mail folder as you require to prove exactly how much was filtered there by SpamAssassin vs BL. On the other hand, Steven Underwood managed to evaluate and explain this situation succinctly without such an enormous waste of time...

[Wazoo]

The tone of your post just proves my point. Most of the "first topic referenced" consisted of you lambasting the writers for not adequately documenting  the problems to your satisfaction, and their angry responses to your clear hostility.

?? My aren't we a bit confused here? In Brazil blocking off air I made exactly one post, referencing the fact that I had updated a pinned entry dealing with the problems at blackholes.us ....???? The only other entries in "this" Topic with multiple references show the "first referenced" item being the Forum version of the SpamCop FAQ, also minus your described 'lambasting and angry responses" ...?????

You really need to learn from your colleagues how to communicate diplomatically.  My posts "here" were very specific and not vague whining and ranting that "it's broke".

Not a single Tracking URL, not even the dreaded "here's my spam" being posted in the raw ... hardly anything specific supplied thus far. Try checking out that "first referenced" item once again (actually reading through it this time)....

  If you really require absolute documentation, I'll be glad to post as many days. weeks, months of spam in my Held Mail folder as you require to prove exactly how much was filtered there by SpamAssassin vs BL.  On the other hand, Steven Underwood managed to evaluate and explain this situation succinctly without such an enormous waste of time...

And other than displaying that you've not paid attention, exactly what would the psting of massive amounts of stuff "from your Held folder" actually demonstrate?

Your repeated statements about the SpamCopDNSbl are also missing any specific data being provided. Already pointed to was the SpamCop FAQ, which has pointers to a FAQ entry on "What is on the list?" ..... Yet, you don't show signs of having actually gone there and attempting to figure out what that all means. That it's all based on an IP address, total e-mail "seen" as compared to the e-mail "reported" and that bit of a math formula being applied to those numbers seems to have gone right by you. Diplomatic or not, answers that do go to some detail have been provided. What's the problem in you doing the follow-up needed to apply those answers to your questions?

There was a reference to 'another' Topic .... Are Country blacklists working? ... there a re a number of "other" issues involved in that 'conversation. Take a hint and notice that it was moved to the Lounge for starters. Take some time to read it, note references there to additional newsgroup traffic, PMs involved, on and on .... trust me, what you find in that exchange is "very diplomatic"

[mshalperin]

Not a single Tracking URL, not even the dreaded "here's my spam" being posted in the raw ... hardly anything specific supplied thus far.  Try checking out that "first referenced" item once again (actually reading through it this time)....

It has nothing to do with the topic of this thread and contained little no no useful information about it's own topic. It was presented to me as relevent to my post, but contained little other than arguments about documentaion,research of the FAQ etc.

And other than displaying that you've not paid attention, exactly what would the psting of massive amounts of stuff "from your Held folder" actually demonstrate?

As I said to you - nothing at all!! You were (are) demanding "data".

Your repeated statements about the SpamCopDNSbl are also missing any specific data being provided.

What "repeated statements" are you referring to? The only thing I stated was that very little of my spam is currently being caught by the BL - almost all by SpamAssassin. I was wondering if this FACT suggested a problem with the BL. I questioned why repeatedly reporting spam from the same source address didn't make any difference. The only "data" I could provide would be to post the contents of the held folder documenting that all was being blocked by SpamAssassin:

[786] kxmxlrvksfdj[at]cashette.com (Brad Pitt always had one Preview )
Thu, 03 Nov 2005 08:46:03 +0600 (Blocked SpamAssassin=18)
[787] annabellekapurkasvtkb[at]rocketmail.com (re: your order for generic sildanefil citrate Preview )
Thu, 03 Nov 2005 13:40:46 +1000 (Blocked SpamAssassin=13)
[788] sandra.wilkins[at]indiatimes.com (Re: Account # 38544P Preview )
Fri, 04 Nov 2005 00:41:10 +0500 (Blocked SpamAssassin=18)
[789] stephanhairstonanomaly[at]miuraboiler.com (is it possible Mia? Preview )
Thu, 03 Nov 2005 10:16:11 +0600 (Blocked SpamAssassin=10)
[790] garybnzev[at]lfucg.com (Weekend gift Preview )
Wed, 3 Nov 2004 07:41:51 -0500 (Blocked SpamAssassin=3)
[791] mdkgrvfflthn[at]eazier.com (number one rated penis growth machine Preview )
Thu, 03 Nov 2005 21:21:03 -0100 (Blocked SpamAssassin=17)
[792] darrens[at]goettsch.com (Pre-approved Application #ZAJJ1870012 Preview )
Wed, 02 Nov 2005 23:18:27 -0600 (Blocked SpamAssassin=19)
[793] hialeah[at]calwia.org (Wet Girls cheating Preview )
Thu, 03 Nov 2005 01:01:54 -0500 (Blocked SpamAssassin=6)
[794] reticulated[at]xxx247.com (Actual News-Letter Preview )
Thu, 3 Nov 2005 03:10:54 -0300 (Blocked SpamAssassin=3)

or posting dozens/hundreds of tracking URL's - do you really go through these?

Already pointed to was the SpamCop FAQ, which has pointers to a FAQ entry on "What is on the list?" ..... Yet, you don't show signs of having actually gone there and attempting to figure out what that all means...Diplomatic or not, answers that do go to some detail have been provided.  What's the problem in you doing the follow-up needed to apply those answers to your questions?

No, there's NOTHING in that FAQ entry could explain why very little spam is blocked by the BL now whereas most of it was in the past. I read and understand how the BL is generated and used but that isn't at all relevant. The likely answer to this issue was provided be Steven Underwood and has to do with the new order in which SpamAssassin (now first) and the BL's are applied. Maybe if you weren't so obsessed with delaring how posted problems are ignorant, undocumented, and unresearched, and actually tried to comprehend what is being said, you might have something more useful to say.

[Wazoo]

It has nothing to do with the topic of this thread and contained little no no useful information about it's own topic.

It may have nothing to do with what you think you asked, but the terms you are using make it very relevent.

What "repeated statements" are you referring to?  The only thing I stated was that very little of my spam is currently being caught by the BL - almost all by SpamAssassin.  I was wondering if this FACT suggested a problem with the BL.  I questioned why repeatedly reporting spam from the same source address didn't make any difference.

And once again, the repeated "problems with the BL" comes into play.

The only "data" I could provide would be to post the contents of the held folder documenting that all was being blocked by SpamAssassin:

[786] kxmxlrvksfdj[at]cashette.com (Brad Pitt always had one Preview )
Thu, 03 Nov 2005 08:46:03 +0600 (Blocked SpamAssassin=18)
  [787] annabellekapurkasvtkb[at]rocketmail.com (re: your order for generic sildanefil citrate Preview )
Thu, 03 Nov 2005 13:40:46 +1000 (Blocked SpamAssassin=13)
  [788] sandra.wilkins[at]indiatimes.com (Re: Account # 38544P Preview )
Fri, 04 Nov 2005 00:41:10 +0500 (Blocked SpamAssassin=18)
  [789] stephanhairstonanomaly[at]miuraboiler.com (is it possible Mia? Preview )
Thu, 03 Nov 2005 10:16:11 +0600 (Blocked SpamAssassin=10)
  [790] garybnzev[at]lfucg.com (Weekend gift Preview )
Wed, 3 Nov 2004 07:41:51 -0500 (Blocked SpamAssassin=3)
  [791] mdkgrvfflthn[at]eazier.com (number one rated penis growth machine Preview )
Thu, 03 Nov 2005 21:21:03 -0100 (Blocked SpamAssassin=17)
  [792] darrens[at]goettsch.com (Pre-approved Application #ZAJJ1870012 Preview )
Wed, 02 Nov 2005 23:18:27 -0600 (Blocked SpamAssassin=19)
  [793] hialeah[at]calwia.org (Wet Girls cheating Preview )
Thu, 03 Nov 2005 01:01:54 -0500 (Blocked SpamAssassin=6)
  [794] reticulated[at]xxx247.com (Actual News-Letter Preview )
Thu, 3 Nov 2005 03:10:54 -0300 (Blocked SpamAssassin=3)

or posting dozens/hundreds of tracking URL's - do you really go through these?
No, there's NOTHING in that FAQ entry could explain why very little spam is blocked by the BL

In the FAQ entry, in my previous, in most other conversations about the BL, nothing is saiid about "source addresses" .... it all works on IP addresses.

now whereas most of it was in the past.  I read and understand how the BL is generated and used but that isn't at all relevant. The likely answer to this issue was provided be Steven Underwood and has to do with the new order in which SpamAssassin (now first) and the BL's are applied. Maybe if you weren't so obsessed with delaring how posted problems are ignorant, undocumented, and unresearched, and actually tried to comprehend what is being said, you might have something more useful to say.

That you want to ask things like "how many times do things need to be reported" .. why doesn't the BL work like it used to" .... then offer up irrelevent data to somehow make your erroneous point is your problem at this point. You want to make this personal, that's your call. However, stuff happens. You will cease with the attitude.

[Jeff G.]

I'll be glad to post as many days. weeks, months of spam in my Held Mail folder as you require

To be clear, the data you posted is from your VER - Very Easy Reporting interface http://mailsc.spamcop.net/reportheld?action=heldlog. Mine shows more BLs vs SpamAssassin, but only 2% country blocklists (both cn.rbl.cluecentral.net; none from blackholes.us):

[23684] catherine[at]optoutdomain.net (SEXUALLY-EXPLICIT: Movies Of A Asian Teen Giving Head In T Preview )
    Wed, 02 Nov 2005 20:58:11 -0800 (Blocked SpamAssassin=20)
[23697] gvjavuxkass[at]hotmail.com (Nasty things Preview )
    Thu, 3 Nov 2005 00:39:14 -0500 (EST) (Blocked SpamAssassin=19)
[23704] xcparxuysj[at]email.cz (Jbdkrm Adamastor degrees Preview )
    Thu, 03 Nov 2005 09:57:15 +0400 (Blocked SpamAssassin=5)
[23715] kkduln[at]verizon.net (The Bottom Line St0ck Preview )
    Wed, 02 Nov 2005 21:37:00 -0800 (Blocked bl.spamcop.net)
[23716] flammablekennedy[at]ameritrade.com (Fwd: Preview )
    Thu, 03 Nov 2005 03:22:10 -0300 (Blocked SpamAssassin=8)
[23721] zqspppprdbn[at]mchsi.com (Platinum St0ck Report Preview )
    Wed, 02 Nov 2005 23:29:17 -0800 (Blocked list.dsbl.org)
[23723] sbwreulorwc[at]proxad.net (Small Cap Insight Preview )
    Wed, 02 Nov 2005 22:07:07 -0800 (Blocked bl.spamcop.net)
[23724] xhxzpwhniv[at]noos.fr (The Next Dynamite St0ck? Preview )
    Wed, 02 Nov 2005 23:43:18 -0800 (Blocked bl.spamcop.net)
[23725] gale_herman_kc[at]mail2diane.com (re: F%, your order Preview )
    Fri, 04 Nov 2005 11:20:58 +0300 (Blocked bl.spamcop.net)
[23728] jpblod[at]optonline.net (emerging oil st0ck Preview )
    Wed, 02 Nov 2005 23:19:19 -0800 (Blocked bl.spamcop.net)
[23734] cainegrape[at]allvantage.com (Thousands of horny singles Preview )
    Thu, 03 Nov 2005 05:09:56 -0200 (Blocked SpamAssassin=16)
[23737] ljnkrzfohndzo[at]msn.com (Request. Preview )
    Thu, 3 Nov 2005 07:28:41 -0500 (Blocked SpamAssassin=15)
[23738] zvgchiar[at]fusemail.com (FW: FW: your private invitation gM-55755my. Preview )
    Thu, 3 Nov 2005 07:27:56 +0000 (Blocked SpamAssassin=15)
[23740] abilenn[at]turbonett.com (igor Treat yourself to a new timekeeper & be frugal at the same time! dreg Preview )
    Thu, 03 Nov 2005 12:16:31 +0400 (Blocked cn.rbl.cluecentral.net)
[23741] tcdmyl[at]cbnyisc.com (New Breed Equity Alert Preview )
    Wed, 02 Nov 2005 23:34:25 -0800 (Blocked bl.spamcop.net)
[23742] m_b_blount_qg[at]gte.net (Next Oil St0ck Set to Skyrocket? Preview )
    Wed, 02 Nov 2005 03:11:20 +0000 (Blocked SpamAssassin=14)
[23748] wtnhnrxahgtbz[at]chinaarmy.net (dont work for him anymore Preview )
    Thu, 03 Nov 2005 01:18:16 -0700 (Blocked SpamAssassin=8)
[23750] ggutu[at]forgaard.com (Re: Have cancel in discriminatory any Preview )
    Thu, 03 Nov 2005 02:34:58 -0600 (Blocked SpamAssassin=18)
[23764] jhannah_50[at]ofir.dk (Online Pharmacy - buy drugs online Preview )
    Thu, 03 Nov 2005 15:34:20 +0600 (Blocked SpamAssassin=20)
[23765] t_leon27[at]stonline.sk (Pharmacy - No prescription required Preview )
    Thu, 03 Nov 2005 11:09:00 +0200 (Blocked SpamAssassin=23)
[23791] zurichjaime[at]mediacom.net (Re: Re: Preview )
    Thu, 03 Nov 2005 06:32:02 -0400 (Blocked SpamAssassin=8)
[23792] daren_666[at]centralsands.com (Meet for Ensured love Preview )
    Thu, 03 Nov 2005 06:37:55 -0400 (Blocked SpamAssassin=23)
[23796] ethalyns[at]fotki.com (Judicial Judgements-Support of Children, Investigator. High $ income Preview )
    Thu, 03 Nov 2005 04:48:42 -0500 (Blocked cn.rbl.cluecentral.net)
[23800] aklgkpsqkngkcm[at]yahoo.com (re[23]: Preview )
    Thu, 03 Nov 2005 05:11:26 -0600 (Blocked SpamAssassin=14)
[23802] jenalynn[at]harekrishnatemple.com (loss Always wanted a luxury timepiece but will not want to deplete luxury prices? monies Preview )
    Thu, 03 Nov 2005 12:26:37 +0000 (Blocked list.dsbl.org)
[23828] morganfarr[at]fibertel.com.ar (Top 10 popular pharmacy drugs Preview )
    Thu, 03 Nov 2005 06:49:27 -0600 (Blocked SpamAssassin=24)

This post has been edited by Jeff G.: Nov 3 2005, 08:26 AM

[mshalperin]

To be clear, the data you posted is from your VER - Very Easy Reporting interface http://mailsc.spamcop.net/reportheld?action=heldlog.  Mine shows more BLs vs SpamAssassin, but only 2% country blocklists (both cn.rbl.cluecentral.net; none from blackholes.us):

Thanks for your input. Here's some more from my VER page - collected this afternoon:

[811] jroblesaw[at]inos.com (Shooting Stars Stock Report Preview )
Wed, 02 Nov 2005 09:05:05 +0000 (Blocked SpamAssassin=9)
[812] bnce[at]elidigital.com (2005 Cardiology Coding: A Year In Review Preview )
Thu, 3 Nov 2005 09:26:04 -0500 (Blocked bl.spamcop.net)
[813] ( Preview )
(Blocked SpamAssassin=10)
[814] jeff[at]mta280.mail.scd.yahoo.com (Don't be inadequate anymore!... roundoff Preview )
Wed, 02 Nov 2005 20:08:31 -0800 (Blocked SpamAssassin=8)
[815] crossbarred[at]cron.cl (Bautiful Whore fu**ed by 14 inch cock Preview )
Thu, 03 Nov 2005 10:12:49 -0500 (Blocked SpamAssassin=3)
[816] stroud[at]familymanagement.com (Lowest rate approved Preview )
Thu, 03 Nov 2005 09:58:28 -0600 (Blocked SpamAssassin=21)
[817] aypmjux[at]everyday.com (Need Cheap Meds? Preview )
Thu, 03 Nov 2005 20:09:39 +0400 (Blocked SpamAssassin=18)
[818] reje[at]soyou.com (Fantasia Asiatica Preview )
Thu, 03 Nov 2005 23:17:47 +0600 (Blocked SpamAssassin=11)
[819] jpaulgs[at]execpc.com (Invest In Oil, Electricity, & Natural Gas Preview )
Wed, 02 Nov 2005 12:34:43 +0000 (Blocked SpamAssassin=9)
[820] brightpair[at]nospam.com (Love sex or friendship Preview )
Thu, 03 Nov 2005 15:12:17 -0400 (Blocked SpamAssassin=11)
[821] awudwo[at]amuro.net (Private Medication Fast Preview )
Fri, 04 Nov 2005 15:31:41 +0100 (Blocked SpamAssassin=11)
[822] aehhpapygwgeb[at]my.money.net (umblemished pregnant coed ladies Preview )
Fri, 04 Nov 2005 19:38:24 +0400 (Blocked SpamAssassin=12)
[823] dietexperts[at]marktwaincollector.com (dose Preview )
Thu, 03 Nov 2005 12:03:08 -0800 (Blocked SpamAssassin=12)
[824] jewell8krueger[at]mate.co.il (Eight hundred pound (800 lb) gorilla, The - said Sparkle Strudel Preview )
Thu, 03 Nov 2005 14:14:17 -0600 (Blocked SpamAssassin=21)
[825] hillary.conrad[at]hotmail.com (Lower Monthly Payments Preview )
Thu, 3 Nov 2005 20:54:12 +0300 (Blocked SpamAssassin=12)
[826] qmuus[at]toughguy.net (rolx or bretling, tagheur and many others Preview )
Thu, 03 Nov 2005 16:59:28 -0400 (Blocked SpamAssassin=12)
[827] sales[at]3xinternet.net (Best prices on medication - get discounts ordering online. Preview )
Thu, 03 Nov 2005 16:16:16 -0500 (Blocked SpamAssassin=16)
[828] heidi.wise[at]keromail.com (Re: Account # 04775K Preview )
Thu, 03 Nov 2005 16:50:25 -0500 (Blocked SpamAssassin=10)
[829] lcvhpfziarljp[at]myfastmail.com (Stop Premature Ejaculation Preview )
Thu, 03 Nov 2005 17:09:02 -0500 (Blocked SpamAssassin=25)
[830] nsyainf[at]sportasia.com (Discrete Medication Fast Preview )
Thu, 03 Nov 2005 20:18:33 -0200 (Blocked SpamAssassin=16)
[831] brigksbin[at]fastmail.ca (Jack Rabbit Vibrator Preview )
Thu, 03 Nov 2005 16:18:11 -0600 (Blocked SpamAssassin=17)
[832] storerooms[at]cavanaughflightmuseum.com (Cute 30 to 40 girls looking for you Preview )
Thu, 03 Nov 2005 18:21:54 -0500 (Blocked SpamAssassin=3)
[833] zwoawyzc[at]gawab.com (Courtney Cox just bought one Preview )
Thu, 03 Nov 2005 18:36:04 -0500 (Blocked SpamAssassin=3)
[834] bxtjocuxow[at]latino.com (pnile fitness device Preview )
Fri, 04 Nov 2005 22:43:37 +0300 (Blocked SpamAssassin=9

22 of the 23 were blocked by SPamAssassin. The only one blocked by the Spamcop BLis a false +. (I processed but didn't report it. The IP address was 209.18.70.50. I researched it - the only site in the DNSStuff database that listed it was the Spamcop BL) Maybe my spam is more susceptible to SpamAssassin filtering than yours.