Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - SFDB not as effective?
  FAQ FAQ  Forum Search   Register Register  Login Login

SFDB not as effective?
 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
Lee_H View Drop Down
Newbie
Newbie
Avatar

Joined: 29 November 2006
Location: United States
Status: Offline
Points: 7 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Lee_H Quote  Post ReplyReply Direct Link To This Post Topic: SFDB not as effective?
    Posted: 28 November 2007 at 10:03am
This past week it seems that the SFDB is far less effective then it used to be! In the past That feature caught the majority of Spam (2/3) now it only accounts for 1/4, how come? I know you changed your server location but have you changed the rules? If so, how can I get them back?
 
Also, the listed IP's in the config is close to whats on your site here....
 
Lee
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104 		Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 28 November 2007 at 10:44am
Lee,

Only the hosting facility has changed, not the rules. As you can see, we still have on average between 300 and 500 thousand IPs blacklisted at anytime.
Can you please try to ping, from the server running SpamFilter, the address:

sfdb.logsat.com

and ensure it returns 66.181.198.something
and not the old addresses 209.26.140.something
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 28 November 2007 at 11:25am
Lee,
 
FYI ... I just looked at my SpamFilter stats for the last 30 days and see nearly the exact same percentage of blocks by the SFDB with the exception of Nov-9 (way higher due to several spam attacks).  Did you change any of your SFDB options?
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com
Back to Top
Lee_H View Drop Down
Newbie
Newbie
Avatar

Joined: 29 November 2006
Location: United States
Status: Offline
Points: 7 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Lee_H Quote  Post ReplyReply Direct Link To This Post Posted: 28 November 2007 at 6:17pm
It's returning the right IP.
 
The only change I've made in many months is to put in sfdb.logsat.com instead of an IP in the ini file!
 
If I understand you, your are seeing 25% caught by SFDB too?
Back to Top
Stupid View Drop Down
Senior Member
Senior Member


Joined: 28 November 2005
Status: Offline
Points: 127 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Stupid Quote  Post ReplyReply Direct Link To This Post Posted: 29 November 2007 at 10:58am
Mine is only 4%. Majority of them (>90%) are caught by Honeypot.
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 29 November 2007 at 11:15am
Lee,
 
I do not recall saying anything about 25% but the blocking stats are about the same as "normal". Below is our normal breakout.
 
Current Msg. total: 124,442 Marked for deletion: 149
No Reverse DNS: 13,802 MX Record Fail: 4,874
SPF Fail: 2,333 IP in MAPS B/L: 69,539
Exc'd max RCPT TO: 1,821 Banned Keywords: 2,996
Email From B/L: 1,060 Email TO B/L: 0
Domain B/L: 7 IP B/L: 40
Banned Attachment: 2 Unident/Banned Country: 312
Bayesian Filter: 0 Anti-Virus Filter: 200
HonyPot Filter: 1 SURBL Filter: 9,472
Image Signature: 30 SFDB Filter: 17,969
Empty w/ Attachment: 1 Max Subject Spaces 20
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com
Back to Top
Stupid View Drop Down
Senior Member
Senior Member


Joined: 28 November 2005
Status: Offline
Points: 127 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Stupid Quote  Post ReplyReply Direct Link To This Post Posted: 29 November 2007 at 12:13pm
How did you pull this up, Desperado?
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 29 November 2007 at 12:23pm

My admin interface does a zillion SQL queries and formats the results.  This is a cut from that page.
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com
Back to Top
jerbo128 View Drop Down
Senior Member
Senior Member
Avatar

Joined: 06 March 2006
Status: Offline
Points: 178 		Post Options Post Options   Thanks (0) Thanks(0)   Quote jerbo128 Quote  Post ReplyReply Direct Link To This Post Posted: 29 November 2007 at 2:19pm
Desperado,
 
Would you mind sending me a screenshot of your SF Admin page?  I am always looking for cool ideas.  jerbo128 / hotmail
 
Thanks
 
Jeremy
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.182 seconds.

Copyright (c)2002-2021 LogSat Software LLC - Sales: sales@LogSat.com
Contact Us