Twelve Minutes

in

Our server runs moderately aggressive filtering, so a significant number of those messages never made it to my mailbox. We use a combination of DNSBLs and local block lists. We tend to be conservative in our choice of DNSBLs, to avoid false positive rejects of legitimate email. Our local block list, however, is quite extensive. Gargantuan, actually. It currently has over 24,000 entries.

Our server filtering was fairly successful in 2002. About 35,000 of the spam attempts were blocked at our server. So the filters are deflecting about 77% of the incoming spam load.

The remaining 10,000 emails ended up as unwanted messages in my mailbox. That's one every 52 minutes. This means while working at my computer, I could count on getting interrupted at least once an hour by an email that turned out to be spam.

What's even more disconcerting is that the problem is getting worse. Much worse. The above graph shows my daily received spam rate through the year. Early in the year, I was seeing about 20 spams/day in my mailbox. At year end the rate was closer to 38.

Here are some of the significant events of the year, which may explain some of the blips you see on the graph:

  • Feb 3 - switched to a new mail server with more effective filtering
  • Feb 22 - added the relays.visi.com block list
  • May 13 - began filtering on obviously forged HELO names
  • May 29 - dropped the mail-abuse.org lists
  • Nov 10 - added the opm.blitzed.org block list
  • Dec 15 (approx) - relays.visi.com goes offline

Comments

Comments have been closed for this entry.

re: Twelve Minutes

WHOA! That spam graph is incredible! What did you use to generate it? Does it include every spam that slipped through your filtering (i.e. did you increment some sort of counter as you hit delete on an incoming spam)?

re: Twelve Minutes

All the spam I receive is saved to a folder. Much of that happens automatically, thanks to spamassassin.
I used a little bit of perl-fu to generate the counts by date received, and then gnuplot to make the graph.

Wish I had something to do curve fitting so I could get a better handle on the growth trend. My eyeball says linear growth, but I'd like a check on that.

re: Twelve Minutes

Chip, maybe you could do something like 30-day, 90-day, 180-day average curves? Those are usually pretty good for trending. Just take the numbers for the last N days, average 'em, plot the point, move forward a day.