IronPort customers - this is Dave Mayer, I am the product manager for IronPort anti-spam as well as SenderBase Reputation Filters. First off, great post! All of you are certainly on the ball when it comes to picking up on spam trends.
As you can see, the spammers are getting tougher and tougher to catch. The good news is that we have a huge team of world class engineers making sure we stay one step ahead of them. We have had a few reports of people saying that certain IPs are sending 100% spam but that their SBRS scores are not being lowered. When I follow up with these customers I ask them if their overall catch rate has decreased because of this trend. All of them have said "no". In fact, every month I do a poll (please shoot me a poll if you'd like to be included in it - the more people the better: dmayer@ironport.com) that asks our customers whether the catch rate of IronPort has gone up, down or stayed the same from the previous 30 days. This month 87% of customers said that the overall catch rate has gone up or stayed the same from the previous month.
The reason that, even though there are more IPs that aren't being blocked but are sending spam hasn't translated into a lower catch rate overall, is that we've chosen to combat these IPs and the spam they send at the content level with IPAS. We've done this because it offered us a way to more quickly and accurately address this trend we've been seeing.
But, we also realize that the farther upstream you can block something, the better. This is especially true for performance sensitive customers. Short term, we have updates to SBRS that should meaningfully cut down the # of IPs that send spam for weeks but don't receive a negative score. This should be available in the next 2-3 weeks.
Our next major release of SBRS (timing TBD but most likely very late q3) will do more to address this trend.
We love hearing feedback like this from our customers. Please keep it coming by emailing me at dmayer@ironport.com or posting to IronPortnation.com. Once the short term patch is rolled out I'll post again to this forum and so I can get feedback.
Dave
