Jump to content

Declining effectiveness of blocklists


mshalperin

Recommended Posts

I set my Spamcop Email filters with all available blocklists activated and SpamAssassin threshold at 3. With this very little spam escapes into my Inbox and even less legitimate mail is held. However, over the last year or so, the percentage of spam picked up by the blocklists has steadily declined from 50-60% to now only 5-10%. Also, of those filtered by blockists, less that half are by the Spamcop bl (I assume that the Spamcop bl is the first one applied). My total spam volume has increased. Most of my mail is sent directly to my Spamcop address, with the rest forwarded from Yahoo (filtering off), Road Runner (no known filtering) and Hotmail (no filtering). Unless there is some silent upstream bl filtering, before getting to Spamcop email, and my true spam volume is much higher than I see, it would appear that the spammers are effectively defeating the Spamcop bl (and others). If the primary (really only) value of reporting spam to Spamcop is to support their bl, what is it now accomplishing?

Link to comment
Share on other sites

Please see the recent discussions of the ineffectiveness of the country blocklists for SpamCop Email System Customers at Brazil blocking off air and Are Country blacklists working?.  Thanks!

35364[/snapback]

Thanks. The first "discussion" was more of a flame-fest and got quickly too tired of the trading insults and minimally intelligible or informative posts to want to finish the thread. Neither thread discussed the minimal current effectiveness of the Spamcop bl itself. The country specific bl's aren't supported by Spamcop reporting. My point is - why bother reporting spam to Spamcop if the bl it produces is nearly useless.

Link to comment
Share on other sites

My point is - why bother reporting spam to Spamcop if the bl it produces is nearly useless.

35365[/snapback]

It's not nearly useless to me, it catches most of my spam. Perhaps your spammers are a little more efficient at finding heretofore-unreported open proxies and zombies than mine are. If so, I'm sorry to hear that, but that makes it even more important for you to Report than it is for me to Report.
Link to comment
Share on other sites

It's not nearly useless to me, it catches most of my spam.  Perhaps your spammers are a little more efficient at finding heretofore-unreported open proxies and zombies than mine are.  If so, I'm sorry to hear that, but that makes it even more important for you to Report than it is for me to Report.

35368[/snapback]

I report as quickly as I can - 2-3hr average report time. Maybe my spammers are more clever, but I see the same source domains over and over agailn without being picked up on the bl. How many reports does it take?

Link to comment
Share on other sites

I set my Spamcop Email filters with all available blocklists activated and SpamAssassin threshold at 3.  With this very little spam escapes into my Inbox and even less legitimate mail is held.  However, over the last year or so, the percentage of spam picked up by the blocklists has steadily declined from 50-60% to now only 5-10%.

35363[/snapback]

Be aware that recently (last month or so), the spamcop email system appears to have changed the order the blocklists are applied with SpamAssassin being checked first and not going any further processing if it is high enough to block. If you check the IP addresses against the various blocklists, most of the time they are listed there as well. I think it was just more efficient to use the local SA settings first then start using network resources to check against the BL's.

My overall false negative (spam getting through) rate has not changed at all.

Link to comment
Share on other sites

Hi!...Please check the link in Pinned: Original SpamCop FAQ Plus - Read before Posting labeled What is on the list? under "SpamCop Blocking List Service" and let us know if that answers your question. Thanks!

35376[/snapback]

Thanks! I've already read that. I was questioning why 95+% of my spam was being trapped by Spamassassin instead of the BL - including the same spam from the same sources that I have repeatedly reported.

Link to comment
Share on other sites

Be aware that recently (last month or so), the spamcop email system appears to have changed the order the blocklists are applied with SpamAssassin being checked first and not going any further processing if it is high enough to block.  If you check the IP addresses against the various blocklists, most of the time they are listed there as well.  I think it was just more efficient to use the local SA settings first then start using network resources to check against the BL's.

My overall false negative (spam getting through) rate has not changed at all.

35389[/snapback]

Thanks for the update. That would explain the big shift to SpamAssasin as the listed trapping agent. I also haven't seen any significant change in false negative or false positive rates. It would seem that SpamAssassin is very efficient and accurate.

Link to comment
Share on other sites

Hi!...Please check the link in Pinned: Original SpamCop FAQ Plus - Read before Posting labeled What is on the list? under "SpamCop Blocking List Service" and let us know if that answers your question. Thanks!

35376[/snapback]

Thanks! I've already read that. I was questioning why 95+% of my spam was being trapped by Spamassassin instead of the BL - including the same spam from the same sources that I have repeatedly reported.

35392[/snapback]

...Hmm ... perhaps I'm confused, but in the post to which I've replied, it doesn't appear so. Here is the exact quote to which I was replying:
I report as quickly as I can - 2-3hr average report time.  Maybe my spammers are more clever, but I see the same source domains over and over agailn without being picked up on the bl.  How many reports does it take?

35372[/snapback]

Link to comment
Share on other sites

Thanks.  The first "discussion" was more of a flame-fest and got quickly too tired of the trading insults and minimally intelligible or informative posts to want to finish the thread.  Neither thread discussed the minimal current effectiveness of the Spamcop bl itself.  The country specific bl's aren't supported by Spamcop reporting.  My point is - why bother reporting spam to Spamcop if the bl it produces is nearly useless.

35365[/snapback]

You've a bit of a strange definition of "flamefest and insult trading" in my opinion. Had you actually read the same thing I just re-read, you'd see that you are repeating the same thing 'here' ... no specific data to support what you are claiming to be a problem. Maybe 90% of the "first topic referenced" is specifically about getting some specific sample data provided so there'd be something to look at beyond "it's broke" ....

Link to comment
Share on other sites

I'm no spam specialist, but doesn't that just mean that new infected computers are being used OR that new sets of IP addresses are infected/zombied?

I wouldn't call that a failure on the BLs, but rather an issue with the computer users of the planet.

Link to comment
Share on other sites

I'm no spam specialist, but doesn't that just mean that new infected computers are being used OR that new sets of IP addresses are infected/zombied?

I wouldn't call that a failure on the BLs, but rather an issue with the computer users of the planet.

35404[/snapback]

I'm not sure what you're getting at, but if spammers are able to circumvent the BL with aggressive "zombification", they have succeeded in making it useless regardless of whose "fault" it is... Actually, Steven Underwood may have explained this with the changed order of spam filtering- now using SpamAssassin first and only applying the BL to those that pass it. This saves system resources (but only if the majority of email is spam caught by SpamAssasin).

Link to comment
Share on other sites

now using SpamAssassin first and only applying the BL to those that pass it.  This saves system resources (but only if the majority of email is spam caught by SpamAssasin).

35406[/snapback]

To the contrary, this saves system resources no matter what fraction of messages are caught by SpamAssassin.
Link to comment
Share on other sites

You've a bit of a strange definition of "flamefest and insult trading" in my opinion.  Had you actually read the same thing I just re-read, you'd see that you are repeating the same thing 'here' ... no specific data to support what you are claiming to be a problem.  Maybe 90% of the "first topic referenced" is specifically about getting some specific sample data provided so there'd be something to look at beyond "it's broke" ....

35396[/snapback]

The tone of your post just proves my point. Most of the "first topic referenced" consisted of you lambasting the writers for not adequately documenting the problems to your satisfaction, and their angry responses to your clear hostility. You really need to learn from your colleagues how to communicate diplomatically. My posts "here" were very specific and not vague whining and ranting that "it's broke". If you really require absolute documentation, I'll be glad to post as many days. weeks, months of spam in my Held Mail folder as you require to prove exactly how much was filtered there by SpamAssassin vs BL. On the other hand, Steven Underwood managed to evaluate and explain this situation succinctly without such an enormous waste of time...

Link to comment
Share on other sites

The tone of your post just proves my point. Most of the "first topic referenced" consisted of you lambasting the writers for not adequately documenting  the problems to your satisfaction, and their angry responses to your clear hostility.

?? My aren't we a bit confused here? In Brazil blocking off air I made exactly one post, referencing the fact that I had updated a pinned entry dealing with the problems at blackholes.us ....???? The only other entries in "this" Topic with multiple references show the "first referenced" item being the Forum version of the SpamCop FAQ, also minus your described 'lambasting and angry responses" ...?????

You really need to learn from your colleagues how to communicate diplomatically.  My posts "here" were very specific and not vague whining and ranting that "it's broke".

Not a single Tracking URL, not even the dreaded "here's my spam" being posted in the raw ... hardly anything specific supplied thus far. Try checking out that "first referenced" item once again (actually reading through it this time)....

  If you really require absolute documentation, I'll be glad to post as many days. weeks, months of spam in my Held Mail folder as you require to prove exactly how much was filtered there by SpamAssassin vs BL.  On the other hand, Steven Underwood managed to evaluate and explain this situation succinctly without such an enormous waste of time...

35408[/snapback]

And other than displaying that you've not paid attention, exactly what would the psting of massive amounts of stuff "from your Held folder" actually demonstrate?

Your repeated statements about the SpamCopDNSbl are also missing any specific data being provided. Already pointed to was the SpamCop FAQ, which has pointers to a FAQ entry on "What is on the list?" ..... Yet, you don't show signs of having actually gone there and attempting to figure out what that all means. That it's all based on an IP address, total e-mail "seen" as compared to the e-mail "reported" and that bit of a math formula being applied to those numbers seems to have gone right by you. Diplomatic or not, answers that do go to some detail have been provided. What's the problem in you doing the follow-up needed to apply those answers to your questions?

There was a reference to 'another' Topic .... Are Country blacklists working? ... there a re a number of "other" issues involved in that 'conversation. Take a hint and notice that it was moved to the Lounge for starters. Take some time to read it, note references there to additional newsgroup traffic, PMs involved, on and on .... trust me, what you find in that exchange is "very diplomatic"

Link to comment
Share on other sites

Not a single Tracking URL, not even the dreaded "here's my spam" being posted in the raw ... hardly anything specific supplied thus far.  Try checking out that "first referenced" item once again (actually reading through it this time)....

It has nothing to do with the topic of this thread and contained little no no useful information about it's own topic. It was presented to me as relevent to my post, but contained little other than arguments about documentaion,research of the FAQ etc.

And other than displaying that you've not paid attention, exactly what would the psting of massive amounts of stuff "from your Held folder" actually demonstrate?

As I said to you - nothing at all!! You were (are) demanding "data".

Your repeated statements about the SpamCopDNSbl are also missing any specific data being provided.

What "repeated statements" are you referring to? The only thing I stated was that very little of my spam is currently being caught by the BL - almost all by SpamAssassin. I was wondering if this FACT suggested a problem with the BL. I questioned why repeatedly reporting spam from the same source address didn't make any difference. The only "data" I could provide would be to post the contents of the held folder documenting that all was being blocked by SpamAssassin:

[786] kxmxlrvksfdj[at]cashette.com (Brad Pitt always had one Preview )

Thu, 03 Nov 2005 08:46:03 +0600 (Blocked SpamAssassin=18)

[787] annabellekapurkasvtkb[at]rocketmail.com (re: your order for generic sildanefil citrate Preview )

Thu, 03 Nov 2005 13:40:46 +1000 (Blocked SpamAssassin=13)

[788] sandra.wilkins[at]indiatimes.com (Re: Account # 38544P Preview )

Fri, 04 Nov 2005 00:41:10 +0500 (Blocked SpamAssassin=18)

[789] stephanhairstonanomaly[at]miuraboiler.com (is it possible Mia? Preview )

Thu, 03 Nov 2005 10:16:11 +0600 (Blocked SpamAssassin=10)

[790] garybnzev[at]lfucg.com (Weekend gift Preview )

Wed, 3 Nov 2004 07:41:51 -0500 (Blocked SpamAssassin=3)

[791] mdkgrvfflthn[at]eazier.com (number one rated penis growth machine Preview )

Thu, 03 Nov 2005 21:21:03 -0100 (Blocked SpamAssassin=17)

[792] darrens[at]goettsch.com (Pre-approved Application #ZAJJ1870012 Preview )

Wed, 02 Nov 2005 23:18:27 -0600 (Blocked SpamAssassin=19)

[793] hialeah[at]calwia.org (Wet Girls cheating Preview )

Thu, 03 Nov 2005 01:01:54 -0500 (Blocked SpamAssassin=6)

[794] reticulated[at]xxx247.com (Actual News-Letter Preview )

Thu, 3 Nov 2005 03:10:54 -0300 (Blocked SpamAssassin=3)

or posting dozens/hundreds of tracking URL's - do you really go through these?

Already pointed to was the SpamCop FAQ, which has pointers to a FAQ entry on "What is on the list?" ..... Yet, you don't show signs of having actually gone there and attempting to figure out what that all means...Diplomatic or not, answers that do go to some detail have been provided.  What's the problem in you doing the follow-up needed to apply those answers to your questions?

No, there's NOTHING in that FAQ entry could explain why very little spam is blocked by the BL now whereas most of it was in the past. I read and understand how the BL is generated and used but that isn't at all relevant. The likely answer to this issue was provided be Steven Underwood and has to do with the new order in which SpamAssassin (now first) and the BL's are applied. Maybe if you weren't so obsessed with delaring how posted problems are ignorant, undocumented, and unresearched, and actually tried to comprehend what is being said, you might have something more useful to say.

Link to comment
Share on other sites

It has nothing to do with the topic of this thread and contained little no no useful information about it's own topic.

It may have nothing to do with what you think you asked, but the terms you are using make it very relevent.

What "repeated statements" are you referring to?  The only thing I stated was that very little of my spam is currently being caught by the BL - almost all by SpamAssassin.  I was wondering if this FACT suggested a problem with the BL.  I questioned why repeatedly reporting spam from the same source address didn't make any difference.

And once again, the repeated "problems with the BL" comes into play.

The only "data" I could provide would be to post the contents of the held folder documenting that all was being blocked by SpamAssassin:

[786] kxmxlrvksfdj[at]cashette.com (Brad Pitt always had one Preview )

Thu, 03 Nov 2005 08:46:03 +0600 (Blocked SpamAssassin=18)

  [787] annabellekapurkasvtkb[at]rocketmail.com (re: your order for generic sildanefil citrate Preview )

Thu, 03 Nov 2005 13:40:46 +1000 (Blocked SpamAssassin=13)

  [788] sandra.wilkins[at]indiatimes.com (Re: Account # 38544P Preview )

Fri, 04 Nov 2005 00:41:10 +0500 (Blocked SpamAssassin=18)

  [789] stephanhairstonanomaly[at]miuraboiler.com (is it possible Mia? Preview )

Thu, 03 Nov 2005 10:16:11 +0600 (Blocked SpamAssassin=10)

  [790] garybnzev[at]lfucg.com (Weekend gift Preview )

Wed, 3 Nov 2004 07:41:51 -0500 (Blocked SpamAssassin=3)

  [791] mdkgrvfflthn[at]eazier.com (number one rated penis growth machine Preview )

Thu, 03 Nov 2005 21:21:03 -0100 (Blocked SpamAssassin=17)

  [792] darrens[at]goettsch.com (Pre-approved Application #ZAJJ1870012 Preview )

Wed, 02 Nov 2005 23:18:27 -0600 (Blocked SpamAssassin=19)

  [793] hialeah[at]calwia.org (Wet Girls cheating Preview )

Thu, 03 Nov 2005 01:01:54 -0500 (Blocked SpamAssassin=6)

  [794] reticulated[at]xxx247.com (Actual News-Letter Preview )

Thu, 3 Nov 2005 03:10:54 -0300 (Blocked SpamAssassin=3)

or posting dozens/hundreds of tracking URL's - do you really go through these?

No, there's NOTHING in that FAQ entry could explain why very little spam is blocked by the BL

In the FAQ entry, in my previous, in most other conversations about the BL, nothing is saiid about "source addresses" .... it all works on IP addresses.

now whereas most of it was in the past.  I read and understand how the BL is generated and used but that isn't at all relevant. The likely answer to this issue was provided be Steven Underwood and has to do with the new order in which SpamAssassin (now first) and the BL's are applied. Maybe if you weren't so obsessed with delaring how posted problems are ignorant, undocumented, and unresearched, and actually tried to comprehend what is being said, you might have something more useful to say.

35417[/snapback]

That you want to ask things like "how many times do things need to be reported" .. why doesn't the BL work like it used to" .... then offer up irrelevent data to somehow make your erroneous point is your problem at this point. You want to make this personal, that's your call. However, stuff happens. You will cease with the attitude.

Link to comment
Share on other sites

I'll be glad to post as many days. weeks, months of spam in my Held Mail folder as you require

35408[/snapback]

To be clear, the data you posted is from your VER - Very Easy Reporting interface http://mailsc.spamcop.net/reportheld?action=heldlog. Mine shows more BLs vs SpamAssassin, but only 2% country blocklists (both cn.rbl.cluecentral.net; none from blackholes.us):
[23684] catherine[at]optoutdomain.net (SEXUALLY-EXPLICIT: Movies Of A Asian Teen Giving Head In T Preview )

    Wed, 02 Nov 2005 20:58:11 -0800 (Blocked SpamAssassin=20)

[23697] gvjavuxkass[at]hotmail.com (Nasty things Preview )

    Thu, 3 Nov 2005 00:39:14 -0500 (EST) (Blocked SpamAssassin=19)

[23704] xcparxuysj[at]email.cz (Jbdkrm Adamastor degrees Preview )

    Thu, 03 Nov 2005 09:57:15 +0400 (Blocked SpamAssassin=5)

[23715] kkduln[at]verizon.net (The Bottom Line St0ck Preview )

    Wed, 02 Nov 2005 21:37:00 -0800 (Blocked bl.spamcop.net)

[23716] flammablekennedy[at]ameritrade.com (Fwd: Preview )

    Thu, 03 Nov 2005 03:22:10 -0300 (Blocked SpamAssassin=8)

[23721] zqspppprdbn[at]mchsi.com (Platinum St0ck Report Preview )

    Wed, 02 Nov 2005 23:29:17 -0800 (Blocked list.dsbl.org)

[23723] sbwreulorwc[at]proxad.net (Small Cap Insight Preview )

    Wed, 02 Nov 2005 22:07:07 -0800 (Blocked bl.spamcop.net)

[23724] xhxzpwhniv[at]noos.fr (The Next Dynamite St0ck? Preview )

    Wed, 02 Nov 2005 23:43:18 -0800 (Blocked bl.spamcop.net)

[23725] gale_herman_kc[at]mail2diane.com (re: F%, your order Preview )

    Fri, 04 Nov 2005 11:20:58 +0300 (Blocked bl.spamcop.net)

[23728] jpblod[at]optonline.net (emerging oil st0ck Preview )

    Wed, 02 Nov 2005 23:19:19 -0800 (Blocked bl.spamcop.net)

[23734] cainegrape[at]allvantage.com (Thousands of horny singles Preview )

    Thu, 03 Nov 2005 05:09:56 -0200 (Blocked SpamAssassin=16)

[23737] ljnkrzfohndzo[at]msn.com (Request. Preview )

    Thu, 3 Nov 2005 07:28:41 -0500 (Blocked SpamAssassin=15)

[23738] zvgchiar[at]fusemail.com (FW: FW: your private invitation gM-55755my. Preview )

    Thu, 3 Nov 2005 07:27:56 +0000 (Blocked SpamAssassin=15)

[23740] abilenn[at]turbonett.com (igor Treat yourself to a new timekeeper & be frugal at the same time! dreg Preview )

    Thu, 03 Nov 2005 12:16:31 +0400 (Blocked cn.rbl.cluecentral.net)

[23741] tcdmyl[at]cbnyisc.com (New Breed Equity Alert Preview )

    Wed, 02 Nov 2005 23:34:25 -0800 (Blocked bl.spamcop.net)

[23742] m_b_blount_qg[at]gte.net (Next Oil St0ck Set to Skyrocket? Preview )

    Wed, 02 Nov 2005 03:11:20 +0000 (Blocked SpamAssassin=14)

[23748] wtnhnrxahgtbz[at]chinaarmy.net (dont work for him anymore Preview )

    Thu, 03 Nov 2005 01:18:16 -0700 (Blocked SpamAssassin=8)

[23750] ggutu[at]forgaard.com (Re: Have cancel in discriminatory any Preview )

    Thu, 03 Nov 2005 02:34:58 -0600 (Blocked SpamAssassin=18)

[23764] jhannah_50[at]ofir.dk (Online Pharmacy - buy drugs online Preview )

    Thu, 03 Nov 2005 15:34:20 +0600 (Blocked SpamAssassin=20)

[23765] t_leon27[at]stonline.sk (Pharmacy - No prescription required Preview )

    Thu, 03 Nov 2005 11:09:00 +0200 (Blocked SpamAssassin=23)

[23791] zurichjaime[at]mediacom.net (Re: Re: Preview )

    Thu, 03 Nov 2005 06:32:02 -0400 (Blocked SpamAssassin=8)

[23792] daren_666[at]centralsands.com (Meet for Ensured love Preview )

    Thu, 03 Nov 2005 06:37:55 -0400 (Blocked SpamAssassin=23)

[23796] ethalyns[at]fotki.com (Judicial Judgements-Support of Children, Investigator. High $ income Preview )

    Thu, 03 Nov 2005 04:48:42 -0500 (Blocked cn.rbl.cluecentral.net)

[23800] aklgkpsqkngkcm[at]yahoo.com (re[23]: Preview )

    Thu, 03 Nov 2005 05:11:26 -0600 (Blocked SpamAssassin=14)

[23802] jenalynn[at]harekrishnatemple.com (loss Always wanted a luxury timepiece but will not want to deplete luxury prices? monies Preview )

    Thu, 03 Nov 2005 12:26:37 +0000 (Blocked list.dsbl.org)

[23828] morganfarr[at]fibertel.com.ar (Top 10 popular pharmacy drugs Preview )

    Thu, 03 Nov 2005 06:49:27 -0600 (Blocked SpamAssassin=24)

Link to comment
Share on other sites

To be clear, the data you posted is from your VER - Very Easy Reporting interface http://mailsc.spamcop.net/reportheld?action=heldlog.  Mine shows more BLs vs SpamAssassin, but only 2% country blocklists (both cn.rbl.cluecentral.net; none from blackholes.us):

35425[/snapback]

Thanks for your input. Here's some more from my VER page - collected this afternoon:

[811] jroblesaw[at]inos.com (Shooting Stars Stock Report Preview )

Wed, 02 Nov 2005 09:05:05 +0000 (Blocked SpamAssassin=9)

[812] bnce[at]elidigital.com (2005 Cardiology Coding: A Year In Review Preview )

Thu, 3 Nov 2005 09:26:04 -0500 (Blocked bl.spamcop.net)

[813] ( Preview )

(Blocked SpamAssassin=10)

[814] jeff[at]mta280.mail.scd.yahoo.com (Don't be inadequate anymore!... roundoff Preview )

Wed, 02 Nov 2005 20:08:31 -0800 (Blocked SpamAssassin=8)

[815] crossbarred[at]cron.cl (Bautiful Whore fu**ed by 14 inch cock Preview )

Thu, 03 Nov 2005 10:12:49 -0500 (Blocked SpamAssassin=3)

[816] stroud[at]familymanagement.com (Lowest rate approved Preview )

Thu, 03 Nov 2005 09:58:28 -0600 (Blocked SpamAssassin=21)

[817] aypmjux[at]everyday.com (Need Cheap Meds? Preview )

Thu, 03 Nov 2005 20:09:39 +0400 (Blocked SpamAssassin=18)

[818] reje[at]soyou.com (Fantasia Asiatica Preview )

Thu, 03 Nov 2005 23:17:47 +0600 (Blocked SpamAssassin=11)

[819] jpaulgs[at]execpc.com (Invest In Oil, Electricity, & Natural Gas Preview )

Wed, 02 Nov 2005 12:34:43 +0000 (Blocked SpamAssassin=9)

[820] brightpair[at]nospam.com (Love sex or friendship Preview )

Thu, 03 Nov 2005 15:12:17 -0400 (Blocked SpamAssassin=11)

[821] awudwo[at]amuro.net (Private Medication Fast Preview )

Fri, 04 Nov 2005 15:31:41 +0100 (Blocked SpamAssassin=11)

[822] aehhpapygwgeb[at]my.money.net (umblemished pregnant coed ladies Preview )

Fri, 04 Nov 2005 19:38:24 +0400 (Blocked SpamAssassin=12)

[823] dietexperts[at]marktwaincollector.com (dose Preview )

Thu, 03 Nov 2005 12:03:08 -0800 (Blocked SpamAssassin=12)

[824] jewell8krueger[at]mate.co.il (Eight hundred pound (800 lb) gorilla, The - said Sparkle Strudel Preview )

Thu, 03 Nov 2005 14:14:17 -0600 (Blocked SpamAssassin=21)

[825] hillary.conrad[at]hotmail.com (Lower Monthly Payments Preview )

Thu, 3 Nov 2005 20:54:12 +0300 (Blocked SpamAssassin=12)

[826] qmuus[at]toughguy.net (rolx or bretling, tagheur and many others Preview )

Thu, 03 Nov 2005 16:59:28 -0400 (Blocked SpamAssassin=12)

[827] sales[at]3xinternet.net (Best prices on medication - get discounts ordering online. Preview )

Thu, 03 Nov 2005 16:16:16 -0500 (Blocked SpamAssassin=16)

[828] heidi.wise[at]keromail.com (Re: Account # 04775K Preview )

Thu, 03 Nov 2005 16:50:25 -0500 (Blocked SpamAssassin=10)

[829] lcvhpfziarljp[at]myfastmail.com (Stop Premature Ejaculation Preview )

Thu, 03 Nov 2005 17:09:02 -0500 (Blocked SpamAssassin=25)

[830] nsyainf[at]sportasia.com (Discrete Medication Fast Preview )

Thu, 03 Nov 2005 20:18:33 -0200 (Blocked SpamAssassin=16)

[831] brigksbin[at]fastmail.ca (Jack Rabbit Vibrator Preview )

Thu, 03 Nov 2005 16:18:11 -0600 (Blocked SpamAssassin=17)

[832] storerooms[at]cavanaughflightmuseum.com (Cute 30 to 40 girls looking for you Preview )

Thu, 03 Nov 2005 18:21:54 -0500 (Blocked SpamAssassin=3)

[833] zwoawyzc[at]gawab.com (Courtney Cox just bought one Preview )

Thu, 03 Nov 2005 18:36:04 -0500 (Blocked SpamAssassin=3)

[834] bxtjocuxow[at]latino.com (pnile fitness device Preview )

Fri, 04 Nov 2005 22:43:37 +0300 (Blocked SpamAssassin=9

22 of the 23 were blocked by SPamAssassin. The only one blocked by the Spamcop BLis a false +. (I processed but didn't report it. The IP address was 209.18.70.50. I researched it - the only site in the DNSStuff database that listed it was the Spamcop BL) Maybe my spam is more susceptible to SpamAssassin filtering than yours.

Link to comment
Share on other sites

To the contrary, this saves system resources no matter what fraction of messages are caught by SpamAssassin.

35407[/snapback]

I don't understand how running SpamAssassin first per se saves resources unless it reduces the load to the BL servers. i.e. if SpamAssassin filters 0% before going to the BL, how does that help?

Link to comment
Share on other sites

The SpamAssassin rules are mostly static. The SpamCop BL is very dynamic.

Remember that all messages must pass through the first filter used.

Your situation suggests that SpamAssassin is catching a high percentage of spam.

When that is the case it definitely reduces the burden on the server for processing the remaining spam.

Link to comment
Share on other sites

It may have nothing to do with what you think you asked, but the terms you are using make it very relevent.

What "terms" make it relevant?

And once again, the repeated "problems with the BL" comes into play.

I never used that phrase. Who are you quoting?

In the FAQ entry, in my previous, in most other conversations about the BL, nothing is saiid about "source addresses" .... it all works on IP addresses.

You are completely right about that. The term I used, "source addresses", is incorrect and ambiguous, though I meant it to mean the IP addresses. Had I used the correct term, would that have enabled you to better evaluate what I presented? How did others manage to explain what happened without my use of the correct terminology? You are using this as a smokescreen for the fact that you show no insight into this matter.

That you want to ask things like: "how many times do things need to be reported" .. why doesn't the BL work like it used to" .... then offer up irrelevent data to somehow make your erroneous point is your problem at this point.

Again, you mis-quote me and don't understand what I presented. What "irrelevant data" are you referring to? The issue was how the BL are being implemented on the SpamCop Email System (that is the title of the discussion group - not the BL per se). The FAQ's, don't discuss that specifically - i.e. in what order the BL's are applied, where SpamAssasin fit in etc. Had it contained that info (particularly the recent change in the order of the filtering) I would have been able to figure this out without starting this topic... This turned out to be the basis of the changes in my spam filtering that I presented with relevant data to document. If you had "paid attention" to what was actually said, you might have grasped this.

You want to make this personal, that's your call.  However, stuff happens.  You will cease with the attitude.

Actually it was you who made this personal with sarcastic, condescending remarks like: "??My, aren't we getting a bit confused here?";"and other than displaying that you've not paid attention...";"What's the problem in you doing the follow-up needed"; etc in your prior posts. Not that you single me out - you spread this good cheer around. If you reread the "referenced topic" http://forum.spamcop.net/forums/index.php?showtopic=5176 (that you stated I needed to re-read for "valuable information") you see that it's mostly hostile exchanges between you and K****j. You start off by attacking him with remarks like:"As I recall, you bad-mouthed folks here, you bad-mouthed folks in the newsgroups, apparently have not attempted to do some of the suggested further research in your own ...." (There was no "bad-mouthing" from him in any prior post in that thread.) It degenerated from there into off-topic arguments about account names, what was and wasn't said in which newsgroup discussions etc. In fact, you eventually said "Take your flame thoughts..." (hence my characterization of that discussion as a "flame-fest"). I really couldn't find anything there relevant to this topic (or even the topic of that discussion).

Link to comment
Share on other sites

(There was no "bad-mouthing" from him in any prior post in that thread.)

35467[/snapback]

While your statement is technically correct, Wazoo's frustration with that person did not appear to start with that Topic - it appears to have started that person's posts to the [sC-Help] Stock inflaters? thread in the spamcop.help newsgroup, registration in these Forums with more than one account, and the PM which launched Topic diatribe against those idiots = ??? (which referenced that [sC-Help] Stock inflaters? thread in http://forum.spamcop.net/forums/index.php?...indpost&p=33817).
Link to comment
Share on other sites

What "terms" make it relevant?

I never used that phrase. Who are you quoting?

What I picked up on and am referring to as "repeated complaints about the SpamCop DNSbl;

[quote=mshalperin,Nov 1 2005, 11:01 PM]
However, over the last year or so, the percentage of spam picked up by the blocklists has steadily declined from 50-60% to now only 5-10%.  Also, of those filtered by blockists, less that half are by the Spamcop bl .... it would appear that the spammers are effectively defeating the Spamcop bl (and others). If the primary (really only) value of reporting spam to Spamcop is to support their bl, what is it now accomplishing?

[quote=mshalperin,Nov 2 2005, 07:40 AM]
I report as quickly as I can - 2-3hr average report time.  Maybe my spammers are more clever, but I see the same source domains over and over agailn without being picked up on the bl.  How many reports does it take?

[quote=mshalperin,Nov 2 2005, 07:57 PM]
I'm not sure what you're getting at, but if spammers are able to circumvent the BL with aggressive "zombification", they have succeeded in making it useless regardless of whose "fault" it is...  

[quote=mshalperin,Nov 3 2005, 01:11 AM]
The only thing I stated was that very little of my spam is currently being caught by the BL - ...... I was wondering if this FACT suggested a problem with the BL.  I questioned why repeatedly reporting spam from the same source address didn't make any difference. ...... No, there's NOTHING in that FAQ entry could explain why very little spam is blocked by the BL now whereas most of it was in the past. 

[quote=mshalperin,Nov 3 2005, 07:16 PM]
The only one blocked by the Spamcop BLis a false +. 

And lest one forgets, check out the Title of this Topic you started ;

"Declining effectiveness of blocklists"

You are completely right about that.  The term I used, "source addresses", is incorrect and ambiguous, though I meant it to mean the IP addresses.  Had I used the correct term, would that have enabled you to better evaluate what I presented?

As the above indicates, yes.

How did others manage to explain what happened without my use of the correct terminology?  You are using this as a smokescreen for the fact that you show no insight into this matter.

See the above. I was responding to all those reamrks. "The others" have SpamCop e-mail accounts.

Again, you mis-quote me and don't understand what I presented.

Once again, I responded to what I read.

What "irrelevant data" are you referring to? The issue was how the BL are being implemented on the SpamCop Email System (that is the title of the discussion group - not the BL per se).  The FAQ's, don't discuss that specifically - i.e. in what order the BL's are applied, where SpamAssasin fit in etc. Had it contained that info (particularly the recent change in the order of the filtering) I would have been able to figure this out without starting this topic... This turned out to be the basis of the changes in my spam filtering that I presented with relevant data to document. If you had "paid attention" to what was actually said, you might have grasped this.

Once again, you were the one that chose to start with the issue of a "failing BL" .... note that it wasn't until after post #8 that "the others" also seemed to sense that you were talking about something else.

Actually it was you who made this personal with sarcastic, condescending remarks like: "??My, aren't we getting a bit confused here?";"and other than displaying that you've not paid attention...";"What's the problem in you doing the follow-up needed"; etc in your prior posts. Not that you single me out - you spread this good cheer around.   If you reread the "referenced topic"  http://forum.spamcop.net/forums/index.php?showtopic=5176  (that you stated I needed to re-read for "valuable information")

You seem to continuously have skipped the word "first" everytime this come up ...

The "first referenced link ..." was used in each instance. I even tried to allow that you were even possibly looking at the wrong post ... and yet ....????

you see that it's mostly hostile exchanges between you and K****j. You start off by attacking him with remarks like:"As I recall, you bad-mouthed folks here, you bad-mouthed folks in the newsgroups, apparently have not attempted to do some of the suggested further research in your own ...." (There was no "bad-mouthing" from him in any prior post in that thread.) It degenerated from there into off-topic arguments about account names, what was and wasn't said in which newsgroup discussions etc. In fact, you eventually said "Take your flame thoughts..." (hence my characterization of that discussion as a "flame-fest"). I really couldn't find anything there relevant to this topic (or even the topic of that discussion).

35467[/snapback]

Thus the comment / suggestion that you note the placement of that particular "discussion" .. the Lounge area, not in a Help Forum .... No you are not privy to the PMs and e-mails between that individual, Deputies, and myself behind all that, but the existing newsgroups post and other Forum traffic is available.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...