The recent increase in spam

[fanf]

A lot of our users have been asking us about the current spam problem, so I sent the following to our computing support staff mailing list and the ucam.comp.mail newsgroup. I thought it would be worth posting here too.

The volume of spam we are seeing has more than doubled since the summer, from about 15 messages blocked per second to over 35, and the amount of spam that gets past the blocks has increased accordingly. This is really unprecedented: in the preceding two years, the volume of blocked spam increased gradually from about 10 to about 15 per second. For comparison, we're handling about 7 messages per second, which includes internal email (3 per second) as well as non-blocked spam and legitimate email from outside the University.

That is, at least 90% of the 3.5 million messages offered to us each day from outside the University are spam.

It is a coincidence that this increase kicked off at about the start of term: this is a global problem that has been widely noted in the IT press. Unfortunately the current flavours of spam are difficult for our second-level filters (SpamAssassin) to handle because it doesn't have many recognizable features, such as URLs for criminal web sites, etc. We are updating SpamAssassin when new releases come out, which is roughly monthly at the moment.

Comments

[dwmalone.livejournal.com]

There's a pretty clear trend in the amount of mail filed to my junkmail folder (either manually or by spamassassin) shown on this graph. Spamassassin is catching most of it, but a certain amount is leaking through. I didn't realise that I was supposed to be running sa-update with 3.1.X versions of Spamassassin, but I think that will help will help catch what's getting through.