spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Matt Kettler <mkett...@evi-inc.com>
Subject RE: sample scoring zero
Date Mon, 02 Aug 2004 21:58:41 GMT
At 04:40 PM 8/2/2004, Pierre Thomson wrote:
>Now I get the SURBL hits too... but not an hour ago!  Maybe on weekends 
>the updates get behind...

No, that's expected behavior. Someone always has to be the "first" one to 
get a spam.

SURBL, like razor, is a live-update system. New listings are added very 
rapidly, so from hour-to-hour the listed domains changes. If you're one of 
the first people to get a spam with a given spamvertized website in it 
before anyone has reported it, it obviously won't be in SURBL. An hour 
later, many people could have reported it, and it will be listed.

Pretty much all live update systems work well, but they can't get all of 
the "first wave" of a particular signature/ip/domain/whatever. It's all a 
matter of the difference in timing between when it was reported and when 
you got the message.

There's also a matter of if the spam hit any automated spamtraps, or only 
hit addresses that have manual reporting. Manual reports generally have a 
much higher latency. A spam hitting a large number spamtraps will get 
listed pretty quickly after it was sent. One that ends up depending on 
manual reports may take several hours.




Mime
View raw message