Subject: RE: [Asrg] Measurements on spam

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Mar 2003 14:54:13 -0800

> Based on my spamtraps, and the figures we get back for rule 
> effectiveness
> across the SpamAssassin developers' corpora, I can tell you that each
> technique varies massively.  On some people's mail, a given technique
> could yield 50% effectiveness; on others, < 1%.

What I am interested in is the types of countermeasures that are being
used and the frequency.

I know the effectiveness of the techniques will change from user to user.

> I reckon this is because there's a high degree of locality between
> (a) a list of addresses and (b) the spammer (or spamming contractor)
> in question.
> 
> This also indicates that some of the bigger spam outfits write (or
> pay to have written) their own spamware.

That is interesting. Note that we have major advantages over the script
kiddie problem. The Spam hauses do not want to share their techiniques.
These are their competative advantage. They know that the more people who
use them, the more counter measures will appear.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "[email-masked]" <[email-masked]>
Date: Tue, 11 Mar 2003 19:45:36 GMT

Hi,

In my experience, with spam arriving to a single domain. 
They do 
arrive in surges and last for few minutes/hours depending on
the spammer,
but generally they occur close to each other. It depends on
the spam list 
being used.

The domain in question ayna.com receives over 400k messages
a day, and most 
of it is spam.  And regardless of what filters are
installed, junk will go
through it.  Many times it bottles up and no mail gets
through until the
spammer attacks slow down. 

As a mail provider I am more inclined to use stamps as a way
to filter out 
spam.  If the spammer wants to get to the network and pays,
that is fine with 
me, as long as I recoup the cost of running the server.

thanks
Adonis

----- Original Message Follows -----
> Â 
> Â 
> ----- Message Forwarded on Tue, 11 Mar 2003 19:37:35 GMT
> -----
> From: Vernon Schryver <[email-masked]>
> To: [email-masked]
> Subject: Re: [Asrg] Measurements on spam
> Date: Tue, 11 Mar 2003 11:31:36 -0700 (MST)
> > from: [email-masked]
> 
> > ...
> > Further, when spam arrives, is it bursty? Does it arrive
> in clumps from > small numbers of sources or is it buried
> uniformly among legitimate traffic > from all sources? ...
> 
> http://www.dcc-servers.net/dcc/graphs/ says that the flow
> of spam is remarkably smooth.  It's the legitimate traffic
> that is not. 
> On the other (albeit anecdotal) hand, my traps get mostly
> Eastern Hemisphere spam when the Western Hemisphere is
> asleep and vice versa. 
> 
> Vernon Schryver    [email-masked]
> Adonis El Fakih, President
> Centipaid Corporation
> m: +1 508.801.0273
> f: +1 603.386.6026
> http://www.centipaid.com

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 11 Mar 2003 19:00:57 -0800

> Alternatively, if a few largish ISPs would be willing to make 
> data files
> available containing <timestamp, source IP, #addresses, 
> spam-flag> tuples
> available for a week or so worth of traffic, then it would be quite 
> interesting.

I suspect that that would be hard. However it is possible that if we come up
with a list we could persuade a group of ISPs to go off and measure their
data and return the results.

Getting clearance to release log files is very hard, abstract research
measurements is much easier.

	Phill