4 ms·

I could bet that most of mails from new IPs are spam because there are much fewer people willing to set up a mailserver than there are spammer operated mailserv

I could bet that most of mails from new IPs are spam because there are much fewer people willing to set up a mailserver than there are spammer operated mailservers. It is cheap to buy a new IP(comes free with many $2 hosting plans). The problem of identifying if a new IP is used for spam is not easy to solve.

bhauer 4y ago
> The problem of identifying if a new IP is used for spam is not easy to solve. How is it not easy to check a reputation database for domains when evaluating a mail server? Using DKIM records, Google could cross-reference the reputation for the sending domain and, where applicable, recognize that the domain in question has never been malicious or negligent. And in that case, extend a probationary reputation sufficient to allow the IP to establish its own new reputation.
- YetAnotherNick 4y ago
  New IP means it is new and not part of any database.
  - bhauer 4y ago
    I'll quote myself: > How is it not easy to check a reputation database for domains when evaluating a mail server? The point I'm making in this thread is that they have the ability to maintain a database of domains that have been proven to be trustworthy. I am not talking about a database of IP addresses, and I am not sure why that is being raised here.
megous 4y ago
> The problem of identifying if a new IP is used for spam is not easy to solve. Huh? With dataset of ~100k classified hams/spams I get like >99% precisison in identifying spam/ham with just bogofilter and 0 heuristics whatsoever (my mail server accepts everything, and I just use bogofilter client side). I guratanee you MS has a dataset with > 100k emails, lol. It's not like this is unsolved problem.
- SoftTalker 4y ago
  Right. While at the same time as they clumsily block any IPs with unknown reputation, they seemingly cannot reliably flag a poorly formatted, obvious and well-known fake invoice for "Norton 360 renewal" as spam (and really, it's worse than spam, it's a scam).
- Avamander 4y ago
  > It's not like this is unsolved problem. My god, are you joking or what? Spam, a solved problem? Far from it.
  - SoftTalker 4y ago
    Why can I identify spam at a glance, with greater than 90% accuracy, from the subject line alone, and to Google it's an unsolved problem? Google reads and indexes every email that they deliver to a gmail inbox. They probably have the worlds largest and highest paid staff of ML experts, and they resort to auto-flagging based on IP address? Fix it.
    - Avamander 4y ago
      > to Google it's an unsolved problem? It's an unsolved problem for anyone. > Why can I identify spam at a glance, with greater than 90% accuracy I don't think you understand how terrible even 99.998% accuracy is at their scale. > They probably have the worlds largest and highest paid staff of ML experts, and they resort to auto-flagging based on IP address? You think they aren't using them for this? IP addresses very likely go into their model as well, when determining something is spam. > Fix it. They are and adversaries are breaking them again.
      - kingjojo23 4y ago
        > I don't think you understand how terrible even 99.998% accuracy is at their scale. What does scale have to do with it, am I missing something? Wouldn’t a spam detection rate of 99.999% mean that only every 100000th spam mail would get through on an account basis, how’s that terrible?

bhauer 4y ago

> The problem of identifying if a new IP is used for spam is not easy to solve. How is it not easy to check a reputation database for domains when evaluating a mail server? Using DKIM records, Google could cross-reference the reputation for the sending domain and, where applicable, recognize that the domain in question has never been malicious or negligent. And in that case, extend a probationary reputation sufficient to allow the IP to establish its own new reputation.

YetAnotherNick 4y ago
New IP means it is new and not part of any database.
- bhauer 4y ago
  I'll quote myself: > How is it not easy to check a reputation database for domains when evaluating a mail server? The point I'm making in this thread is that they have the ability to maintain a database of domains that have been proven to be trustworthy. I am not talking about a database of IP addresses, and I am not sure why that is being raised here.

megous 4y ago

> The problem of identifying if a new IP is used for spam is not easy to solve. Huh? With dataset of ~100k classified hams/spams I get like >99% precisison in identifying spam/ham with just bogofilter and 0 heuristics whatsoever (my mail server accepts everything, and I just use bogofilter client side). I guratanee you MS has a dataset with > 100k emails, lol. It's not like this is unsolved problem.

SoftTalker 4y ago
Right. While at the same time as they clumsily block any IPs with unknown reputation, they seemingly cannot reliably flag a poorly formatted, obvious and well-known fake invoice for "Norton 360 renewal" as spam (and really, it's worse than spam, it's a scam).
Avamander 4y ago
> It's not like this is unsolved problem. My god, are you joking or what? Spam, a solved problem? Far from it.
- SoftTalker 4y ago
  Why can I identify spam at a glance, with greater than 90% accuracy, from the subject line alone, and to Google it's an unsolved problem? Google reads and indexes every email that they deliver to a gmail inbox. They probably have the worlds largest and highest paid staff of ML experts, and they resort to auto-flagging based on IP address? Fix it.
  - Avamander 4y ago
    > to Google it's an unsolved problem? It's an unsolved problem for anyone. > Why can I identify spam at a glance, with greater than 90% accuracy I don't think you understand how terrible even 99.998% accuracy is at their scale. > They probably have the worlds largest and highest paid staff of ML experts, and they resort to auto-flagging based on IP address? You think they aren't using them for this? IP addresses very likely go into their model as well, when determining something is spam. > Fix it. They are and adversaries are breaking them again.
    - kingjojo23 4y ago
      > I don't think you understand how terrible even 99.998% accuracy is at their scale. What does scale have to do with it, am I missing something? Wouldn’t a spam detection rate of 99.999% mean that only every 100000th spam mail would get through on an account basis, how’s that terrible?