2007-03-19 ========== IPs tracked: 1,390,751 -- total IP addresses in database IPs blocked: 205,222 -- IP addresses on published block list Block rates on sample mail dnsbl 21% of queries return 127.0.0.2 (listed) Account W 25% blocked of 270016 spam Account X 27% blocked of 9150 spam Account Y 27% blocked of 13505 spam Account Z 27% blocked of 19669 spam False positives 1 confirmed false positive from above test accounts. 2007-02-03 ========== IPs tracked: 1,067,059 -- total IP addresses in database IPs blocked: 194,220 -- IP addresses on published block list OUR DATABASE NOW STORES SIGHTINGS ON OVER 1 MILLION IP ADDRESSES! Block rates on sample mail dnsbl 15% of queries return 127.0.0.2 (listed) Account W 22% blocked of 48987 spam Account X 27% blocked of 8339 spam Account Y 29% blocked of 7186 spam Account Z 24% blocked of 14943 spam False positives There were 2 confirmed false positives from the accounts listed above, where an IP address sending legitimate mail appeared on the block list. Other comments Note that the above accounts do not have any other spam filtering applied. Also, since these accounts feed WPBL the block rate is going to be higher for these accounts than at an average ISP account. 2007-01-14 ========== IPs tracked: 820,687 -- total IP addresses in database IPs blocked: 156,949 -- IP addresses on published block list Block rates on sample mail dnsbl 22% of queries return 127.0.0.2 (listed) Account X 25% blocked of 1400 spam Account Y 27% blocked of 1886 spam Account Z 23% blocked of 2370 spam False positives There were no false positives on the test accounts during the test. However, with the growth of the list it is increasingly likely that false positives will result in the real world. In particular, WPBL lists sources of backscatter UBE which are mail servers that can also send legitimate non-spam. We continue to try minimizing false positives. We continue to advise you to not use WPBL for black-and-white filtering. Other comments The spam detection network feeding WPBL has grown dramatically. The expire variable has been changed to RECENT=4 days so that listed IPs are removed more quickly, after 4 days without receiving new spam. Success rate on real world spam is approximately 20% to 25% 2006-07-10 ========== IPs tracked: 455,712 -- total IP addresses in database IPs blocked: 69,010 -- IP addresses on published block list Account X 25% blocked of 2842 spam Account Y 31% blocked of 1674 spam Account Z 21% blocked of 2971 spam False positives 1 The spam levels at our traps have increased dramatically, and the database now tracks nearly half a million IP addresses (new record for the project). The blocklist grew to new record 70,000 blocked IPs on July 9, 2006. The effectiveness of the blocklist on our sample real accounts has not changed over the past 6 months. There has been 1 false positive in the last month, on these real accounts used for testing. 2005-11-23 ========== IPs tracked: 177354 -- total IP addresses in database IPs blocked: 30463 -- IP addresses on published block list Account X 24% blocked of 1610 spam Account Y 31% blocked of 868 spam Account Z 22% blocked of 1392 spam The database has resumed growing since summer as overall spam levels have increased. Effectiveness on real accounts has also increased with no false positives in the sample set. The new software implemented over the summer is proving to have better reliability and faster update/expire/export. 2005-06-04 ========== IPs tracked: 157267 -- total IP addresses in database IPs blocked: 27666 -- IP addresses on published block list Account X 21% blocked of 821 spam Account Y 21% blocked of 591 spam Account Z 21% blocked of 1208 spam False positives 3 The database size is shrinking as we have lost one of our large spam traps. Effectiveness on real accounts is quite consistent. There have been 3 known false positives in the blocklist over the past four months. 2005-01-23 ========== IPs tracked: 215509 -- total IP addresses in database IPs blocked: 43320 -- IP addresses on published block list Account X 26% blocked of 572 spam Account Y 30% blocked of 926 spam Account Z 26% blocked of 1047 spam False positives 2 Database size quite stable over past month, equilibrium between new sightings and expiring records. Effectiveness on real accounts dropped to 27%. WPBL caught two messages that were not spam (false positives). Multiple traps received spam (confirmed) from these IPs within past few days -- case of good customer on bad ISP. 2004-11-28 ========== IPs tracked: 214975 Normal blocked: 43336 -- 20% of database Multi-blocked: 32652 -- 75% of blocked IPs are long-term Lone sightings: 160192 -- 75% of database Account X 37% blocked (of 850 spam) Account Y 34% blocked (of 920 spam) Account Z 33% blocked (of 951 spam) False positives 0 Effectiveness on real mail accounts has improved, on average blocking 35% of spam received. Database size has increased slightly, other proportions unchanged. 2004-10-22 ========== IPs tracked: 199794 Normal blocked: 41419 -- 21% of database Multi-blocked: 30950 -- 75% of blocked IPs are long-term Lone sightings: 150113 -- 75% of database Account X 30% blocked (of 921 spam) Account Y 27% blocked (of 958 spam) Account Z 30% blocked (of 1447 spam) False positives 0 Effectiveness on real mail accounts slightly lower, catches on average 29% of spam. Database has grown slightly. Now fewer long-term blocks and more lone sightings. This implies that filter/traps are picking up more distinct spams, fewer same senders. 2004-08-08 ========== IPs tracked: 189433 Normal blocked: 40597 -- 21% of database Multi-blocked: 31724 -- 78% of blocked IPs are long-term Lone sightings: 137352 -- 73% of database Effectiveness of WPBL on 3 real mail accounts: Account X 30% blocked (of 537 spam) Account Y 31% blocked (of 802 spam) Account Z 29% blocked (of 855 spam) False positives 1 (an admin replying from a server that previously spammed) The database is still shrinking, as the volume of sightings has decreased. Effectiveness appears unchanged, blocking just under 1/3 of all spam. 2004-07-16 ========== IPs tracked: 224,506 Normal blocked: 44,774 -- 20% of database Multi-blocked: 36,035 -- 80% of blocked IPs are long-term Lone sightings: 158,236 -- 70% of database Using tagging of IPs according to WPBL block state, % of spam received at real email accounts that would have been blocked by WPBL. In other words, WPBL_blocked / spam_received over a 6 day window. Account X 28% blocked (of 554 spam) Account Y 33% blocked (of 818 spam) Account Z 25% blocked (of 741 spam) False positives 0 (no ham caught on accounts X, Y, Z) The database has started to shrink because the rate of old record expiry exceeds the rate of new incoming sightings. The new numbers also show the effectiveness of WPBL on some accounts which are contributing data to WPBL. The blocklist is catching anywhere from one-quarter to one-third of spam! 2004-06-06 ========== IPs tracked: 248,075 Normal blocked: 49,364 -- 20% of database Multi-blocked: 40,440 -- 82% of blocked IPs are long-term Lone sightings: 176,152 -- 71% of database The database is still growing, though at a slower rate than before. Proportions shown above have changed little since last month. The "multi-blocked" list (wpbl-mblocks.cidr) is a more cautious listing than the normal blocklist (wpbl-blocks.cidr) as it only includes IP addresses seen sending spam by 2 or more distinct uids. 2004-05-07 ========== IPs tracked: 204,000, doubled since last month IPs blocked: 38,000 (19% of db), proportion down to usual level Long-term blocks: 82% of blocks, proportion up substantially from previous Lone sightings: 71% of db, slightly down 2004-04-07 ========== The database currently stores 104,000 IP addresses. Approximately 31,000 IPs or 30% of the total IPs are 'blocked'. This proportion has risen substantially from the previous level of 20%. Of the IPs currently blocked, 51% are short term (transient) and 49% are longer term (steady-state), unchanged from last month. Approximately 74% of all IPs have only been sighted once. Since this number has dropped, this is good news: increasingly, the project members are collectively sighting the same IP addresses. 2004-03-06 ========== The database currently stores about 43,000 IP addresses. Approximately 8900 IPs, or 20% of the total IPs, are in the 'blocked' state. This proportion has remained relatively constant over the lifetime of WPBL. Of the IPs currently blocked, 51% are short term (transient) blocks and 49% are longer term (steady-state) blocks. It is encouraging that the proportion of steady-state blocks has increased over time. Approximately 80% of all IP addresses on record have only one report. 2004-02-22 ========== Over the past month, the total number of IP addresses in the database has increased linearly from about 19,000 to currently about 38,000. The number of IP addresses that are 'blocked' has hovered around 20% of the total IPs in the database, as a proportion. There is a high turnover rate for the blocklist because most blocks are short (5 days) in duration. The blocklist is therefore composed of mainly two components: (1) short blocks, and (2) relatively long-term blocks due to multiple spam sightings. Of all the IPs currently blocked, approximately 56% are short blocks and 44% are longer blocks enforced by multi-user spam sightings. Another interesting metric is the proportion of IP addresses that have only been spotted once (i.e. isolated sightings). Currently, approximately 81% of all IP addresses on record have only one report.