Hi Markus:

I'm curious:

>> All of this 24 messages are NDR's or "Notifications" send from "<>" back
to the recipient.<<

Why did these NDRs contain a "blocked" URL?  Were they indeed "wanted" NDRs,
or were they NDRs for Spam that wasn't delivered, which happened to have one
of your users as the faked sender?

Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:    +1 201 934-9206

http://www.HM-Software.com/


-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Friday, April 16, 2004 04:25 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] SURBL filter script



> It will take a day or two before the log analysis and test
> check scripts are available, since I must adjust them to 
> handle all log levels.

Here are my results from 04/15/2004

Processed messages: 9832

Hold as Spam:       4728  (48% of all messages)
Detected by SURBL:  2552  (54% of hold spam / 26% of all messages)

FP's from SURBL:      24
All of this 24 messages are NDR's or "Notifications" send from "<>" back to
the recipient. None of this SURBL false positives has caused a message to
reach the hold weight and so become a real FP.

95% of all spam messages catched by SURBL has already reached a weight >
200% of our hold weight. So inserting a initial SKIPIFWEIGHT should
significantly save resources.

Excellent test!

Markus


---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe,
just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe
Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to