Very poor Spamcop stop rates

[Lking]

I was working under the assumption that, since I get so many of these, that a lot of other people are, too. ...

Drake

Timing is another thing to consider. For example:

Lets assume the an IP address is not on the SpamCop Black list because it is a new IP or one of several used by the spammer in rotation so this IP has timed off of the BL. Using this unlisted IP the spammer starts sending his trash, being lucky they don't send anything to a honeypot. But during the first minute or two they send say 10,000 spam including several to you. Until some number of those spam are reported by you or others the IP will not get on, or back on, the BL.

So from an individual's prospective it may look ineffective. However, those that receive any of the 90,000+ spam sent from this IP after it gets back on the list may have a different view. It is difficult to evaluate the "big" picture result when we are looking through the 'straw' of our own limited view/account.

I assume the spam you are talking about are in you inbox, not placed in your hold folder as possible spam.

[Mighty]

I assume the spam you are talking about are in you inbox, not placed in your hold folder as possible spam.

Correct. That's what prompted me to start this thread.

Too bad Spamassassin doesn't spot big stretches of blank lines and generate separate Bayesian scores for the chunks of text. That could be another heuristic to watch for, to split out the spam text from the junk text.

Sorry, just rambling.

Drake

[raydragon]

If you can summarise the SpamAssassin scores for the ones that make it to your Inbox ?

Where in the header do I find that score (I "think" I've got it, but just want to be sure).

[Dave_L]

Where in the header do I find that score (I "think" I've got it, but just want to be sure).

I think it's this:

X-spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on filter8

X-spam-Level: ****

X-spam-Status: hits=4.7 tests=DATE_IN_PAST_12_24,TVD_SPACE_RATIO version=3.2.4

X-spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on filter8

X-spam-Level:

X-spam-Status: hits=0.3 tests=DIET_1,HTML_MESSAGE version=3.2.4

In the first example, the score is 4.7. In the second, it's 0.3.

[Ex_Brit]

I think these lines are important too:

X-SpamCop-Checked:

X-SpamCop-Disposition: Blocked SpamAssassin=4

[michaelanglo]

I think these lines are important too:

X-SpamCop-Checked:

X-SpamCop-Disposition: Blocked SpamAssassin=4

Interesting, rather.

The =4 is a transcription of

X-spam-Level: ****

and the rest depends on what level you have set plus whitelisting and any other checks.

[Ex_Brit]

My SA limit is 1 and I use whitelisting. Everyone uses different ones.

[Mighty]

Today, most of my spam has a Spamassassin level of 0.5. A few have crept up close to 2. The few that have been stopped were 4 or 5.

Drake

[michaelanglo]

Today, most of my spam has a Spamassassin level of 0.5. A few have crept up close to 2. The few that have been stopped were 4 or 5.

So, if this is typical, even setting the level to 1 wouldn't help you much.

Eash person's settings may vary of course but in the 10+ years I've used SC it's been excellent and I've hardly ever received any spam in my actual email client inbox. It's blocked everything bad.

Settings I have are as follows but as I said, results may vary do play around with them:

Options, Select your email filtering blacklists.

Block All - yes (checked)

Tag Only - blank (unchecked)

SpamAssassin - Checked and set to limit '1'

Block Russian - yes (checked)

DNS Blacklists - all are selected.

Click Submit if you changed anything.

Try adjusting settings and I think you'll find it works well.

I do not use the graylist as it, for me at least, simply adds complication to the equation.

If you have Block All checked then surely the SpamAssassin limit doesn't do anything ?

[Ex_Brit]

That's a setting I was advised to use years ago and I've stuck with it. Not sure how it all works to be honest.

[AggieLady]

I am having the same problem: SpamCop used to block most (maybe 90%) of the spam and send it to Held Mail. For the past few months, more spam has been getting through than is sent to Held Mail, and less than 10 % is being blocked. For example, I cleaned out my held mail box yesterday afternoon. Since that time, I've gotten 60 emails, 43 of which were spam that was NOT filtered out. My held mailbox was empty.

I have spam Assassin set to 3 and all the other filters checked. The only thing I haven't used is "Block All." Is there a less drastic option that will work?

It does seem that the filters are just not working.

[michaelanglo]

I am having the same problem: SpamCop used to block most (maybe 90%) of the spam and send it to Held Mail. For the past few months, more spam has been getting through than is sent to Held Mail, and less than 10 % is being blocked. For example, I cleaned out my held mail box yesterday afternoon. Since that time, I've gotten 60 emails, 43 of which were spam that was NOT filtered out. My held mailbox was empty.

I have spam Assassin set to 3 and all the other filters checked. The only thing I haven't used is "Block All." Is there a less drastic option that will work?

It does seem that the filters are just not working.

As noted we to need to look at the SpamAssassin hits for those that got through ('Leaked') it may be that setting the level to 2 will help.

Somewhere you can find my notes on How I use SpamCop mail. The only extras I use is that I have items in my personal blacklist such as Blacklist br (Brazil) and biz and mx

But last month I only got 10 Spams in Held of which 4 were from personal blacklist items and 2 leaks (my oldest mailbox now is strong filtering applied by the ISP).

[Mighty]

I've dropped my Spamassassin to 2. That's managed to increase the stoppage rate to around 50%. But, of course, now I'm seeing some false positives.

Again, frustrating and disappointing that the old techniques went south so suddenly.

Drake

[michaelanglo]

I've dropped my Spamassassin to 2. That's managed to increase the stoppage rate to around 50%. But, of course, now I'm seeing some false positives.

Again, frustrating and disappointing that the old techniques went south so suddenly.

Drake

If you now whitelist the false positives and blacklist all the country codes (that you don't have senders using) things should improve a bit more.

Most of the leakers I see can't be stopped without triggering yet more false positives.

[Mighty]

I've been whitelisting for years. So, most of my contact list is in there by now. But not all of them, I think.

[AggieLady]

Thanks for the helpful suggestions. I've dropped spam Assassin to 1. It doesn't seem to have made much difference. I'm trying to build a personal blacklist now to try to filter out as much as possible.

[michaelanglo]

Thanks for the helpful suggestions. I've dropped spam Assassin to 1. It doesn't seem to have made much difference. I'm trying to build a personal blacklist now to try to filter out as much as possible.

I don't think going down to 1 helps much.

Curiously my spam rate has just doubled from a rate of 20/month to 40/month but all the extras have been stopped by xbl or SA=3

[davem4]

40 per month??? Wow! I've received 1652 spams in the last month. Are you using additional spam filtering service(s) prior to spamcop?

[michaelanglo]

40 per month??? Wow! I've received 1652 spams in the last month. Are you using additional spam filtering service(s) prior to spamcop?

(above) "But last month I only got 10 Spams in Held of which 4 were from personal blacklist items and 2 leaks (my oldest mailbox now is strong filtering applied by the ISP)."

Can't switch it off but until I can prove something I want didn't arrive, nothing much to complain of.

(edit add)

Back in 2008 I noted

last month I got

2799 spams (90/d), 130 leakers (=4.6 %), 3 false positive(s)

==

[Mighty]

I dropped my Spamassassin to 2 a coupla days ago, and it has raised the stop rate to about 60%. It's nice to finally see a long list on the Held Mail page, again. Except, there have been a few false positives.