Thread: Spam protection
View Single Post
Old 24 Jul 2019, 01:19 PM   #30
xyzzy
Essential Contributor
 
Join Date: May 2018
Posts: 474
I joined FM a little over a year ago. Initially I was getting 30-40 spams a day! I've had my real email account since the 90's. Hard to have hid it from the spammers over such a length of time particuallry since my "public" email account is a forwarding service maintained by a large professional computer organization.

Today I am down to essentially 0 spams. So I am happy with FM (now).

Stop reading here unless you are curious how all this came about...

------

It took me a while to get the "feel" for the spam score range in "my universe" of spam (I believe everybody's "universe" is different with some overlap of course). When I settled on a range (spam threshold >= 6.2, spam discard >= 9.1 seems good enough at the moment) that cut spam down to around 25+ per day (doing this from my aging memory).

During all this time I also "trained" my Sieve code to pick off the "repeat offenders" (as I like to call them - 90%+ of them are repeat offenders) to filter into spam even if they would otherwise be treated as not spam.

When Spam Protection's spam and non-spam learned reached the requisite 200 threshold spam dropped abruptly to under 5. It was a big enough drop to make wonder why it dropped so so much so suddenly.

Now recently I have had another abrupt drop in my spam to 0, sometimes 1 on a "bad day". In fact I was a little concerned about this second large drop (first one might have been due to reaching the 200 spam/non-spam learned threshold) and currently have disabled my spam discard threshold to see what is getting discarded.

Even with the threshold disabled what little spam I see now all has scores greater than the spam discard threshold I was using. As soon as I re-enable it I will have 0 spam again on the average. I'm sure some little sneaker will get into spam now an then. But that's also true for gmail as well.

So as I said I'm happy with FM spam handling. And what might come through can be handled by spam training and/or Sieve if necessary. IMO in Sieve everything is more compact and easier to read than doing some of this testing using UI Organize Rules.

Another stopping point. But in case anyone is interested how I use Sieve to handle spam in addition to spam training and the spam score range, here's what I am doing. This evolved over time and why I wanted to originally learn Sieve.

------

My sieve code has 5 categories of spam checking.
  1. Repeat offenders that are the worst of the worst to be unconditionally discarded (although currently I still just put them in their own folder). At the moment none of my spammers have "graduated" to this category.
  2. Repeat offenders that had been sometimes (not always) slipping under the spam score threshold. These are determined by recording their From and Subject over say 6 or more additional spam instances and looking for unique patterns I can test for (parts of the email address or subject line). Now I may need to reduce this list of what I currently got (about 25) if they continue to now have scores over the discard threshold where they didn't previously. Does repeated training of the same spam increase it's spam score over time? That seems to be what has happened.
  3. Many months of analyzing my spam has shown that almost all of my spam (99%) has X-Spam-Source showing the same small (5) list of host name patterns. For example containing the string greyink, digitalink, webink, and mail-labXX, webstudioXX (XX are digits). So email getting to this category is placed in their own folder further review.
  4. If X-ME-VSCategory indicates scam, spam, or phishing, then hey, who am I to argue? I stick these in spam too.
  5. Over time I've encountered 3 foreign spams. So if it gets through 1-4 above I check the From and Subject lines for Russian, Turkish, and Dutch characters. It's not perfect (particularly Dutch) but good enough. This seemed like a good idea at the time so I left it in.
Anyway, right or wrong, this is what I am doing. So far so good. I just thought I would share it.

Last edited by xyzzy : 25 Jul 2019 at 11:58 AM.
xyzzy is offline   Reply With Quote