Print Page | Close Window

SFDB not as effective?

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6309
Printed Date: 13 March 2025 at 6:05pm


Topic: SFDB not as effective?
Posted By: Lee_H
Subject: SFDB not as effective?
Date Posted: 28 November 2007 at 10:03am
This past week it seems that the SFDB is far less effective then it used to be! In the past That feature caught the majority of Spam (2/3) now it only accounts for 1/4, how come? I know you changed your server location but have you changed the rules? If so, how can I get them back?
 
Also, the listed IP's in the config is close to whats on your site here....
 
Lee


Replies:
Posted By: LogSat
Date Posted: 28 November 2007 at 10:44am
Lee,

Only the hosting facility has changed, not the rules. As you can see, we still have on average between 300 and 500 thousand IPs blacklisted at anytime.
Can you please try to ping, from the server running SpamFilter, the address:

sfdb.logsat.com

and ensure it returns 66.181.198.something
and not the old addresses 209.26.140.something



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Desperado
Date Posted: 28 November 2007 at 11:25am
Lee,
 
FYI ... I just looked at my SpamFilter stats for the last 30 days and see nearly the exact same percentage of blocks by the SFDB with the exception of Nov-9 (way higher due to several spam attacks).  Did you change any of your SFDB options?


-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: Lee_H
Date Posted: 28 November 2007 at 6:17pm
It's returning the right IP.
 
The only change I've made in many months is to put in sfdb.logsat.com instead of an IP in the ini file!
 
If I understand you, your are seeing 25% caught by SFDB too?

Posted By: Stupid
Date Posted: 29 November 2007 at 10:58am
Mine is only 4%. Majority of them (>90%) are caught by Honeypot.

Posted By: Desperado
Date Posted: 29 November 2007 at 11:15am
Lee,
 
I do not recall saying anything about 25% but the blocking stats are about the same as "normal". Below is our normal breakout.
 
Current Msg. total: 124,442 Marked for deletion: 149
No Reverse DNS: 13,802 MX Record Fail: 4,874
SPF Fail: 2,333 IP in MAPS B/L: 69,539
Exc'd max RCPT TO: 1,821 Banned Keywords: 2,996
Email From B/L: 1,060 Email TO B/L: 0
Domain B/L: 7 IP B/L: 40
Banned Attachment: 2 Unident/Banned Country: 312
Bayesian Filter: 0 Anti-Virus Filter: 200
HonyPot Filter: 1 SURBL Filter: 9,472
Image Signature: 30 SFDB Filter: 17,969
Empty w/ Attachment: 1 Max Subject Spaces 20


-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: Stupid
Date Posted: 29 November 2007 at 12:13pm
How did you pull this up, Desperado?

Posted By: Desperado
Date Posted: 29 November 2007 at 12:23pm

My admin interface does a zillion SQL queries and formats the results.  This is a cut from that page.



-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: jerbo128
Date Posted: 29 November 2007 at 2:19pm
Desperado,
 
Would you mind sending me a screenshot of your SF Admin page?  I am always looking for cool ideas.  jerbo128 / hotmail
 
Thanks
 
Jeremy


Print Page | Close Window