Subject: [Asrg] 2.a Greylisting stops 85% of spam.

From: Scott Nelson <[email-masked]>
Date: Fri, 29 Aug 2003 20:29:18 -0700

I recently ran a test of greylisting on some of my spamtrap addresses.

Caveats: the addresses are presumed to only receive spam, so they
are not a "random uncorrelated" sample, but it is hoped that the
correlations do not contaminate the results.  
Any of those assumptions could be wrong, and the possibility that 
I've made some horrible error should not be discounted.

I split 200 addresses into four group of 50 each,
by sorting alphabetically, and then alternating down the list.
I call them spam0, spam1, spam2 and spam3.

For the first part of the test, (2003-07-13 23:59 to 2003-08-01 10:20)
spam2 and spam3 were greylisting, spam0 and spam1 were not.
In the second part, (2003-08-01 14:17 to 2003-08-21 09:32)
spam2 and spam0 were greylisting, spam3 and spam1 were not.
IOW, spam0 and spam3 changed, but spam1 and spam2 did not.

Total RCPTs
Spam0 - 310                          267
Spam1 - 494                          366
Spam2 - 1330                        1077
Spam3 - 1900                        1113

Emails accepted/unique senders emails accepted
Spam0 - 310, 290                47,   25
Spam1 - 494, 404               366,  297
Spam2 - 268, 129               247,  122
Spam3 - 120, 111              1113, 1068

Total deferred
spam0 - 0                            220
spam1 - 0                              0
spam2 - 1062                         830
spam3 - 1780                           0

***************
Parsed results;
Note that these addresses get considerably less spam than the
"average" mailbox, and the numbers are relatively small,
so the error margins are probably large.  Still, a good rule of
thumb is +/- the square root of the number which translates 
to +/- 10% for these numbers.

If we do /nothing/ but greylisting, it stops between 80-95% 
of all spam attempts. 
Blocking semi-legitimate mailing lists (for example, equalamail.deliveroffers.com) increases this to 91-97%.  

I was originally concerned that there appeared to be a significant 
increase in the number of attempts, and that greylisting might
not have been as effective in decreasing in /total/ spam volume
as the numbers suggested.  There is an increase, but it's not
as large as I first thought, and the increase is close to the 
expected error rate.  Even adjusting for this by assuming the worst, 
greylisting is still better than 75% effective.

Scott Nelson <[email-masked]>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 30 Aug 2003 21:29:15 -0400

I think we need to analyze the data statistically and see what it means.

At 11:29 PM 8/29/2003, Scott Nelson wrote:
>Blocking semi-legitimate mailing lists (for example, 
>equalamail.deliveroffers.com) increases this to 91-97%.
>