GBUdb

It appears that all of the IPs that I test turn up as ugly in GBUdb. Am I doing something wrong?

You're not doing anything wrong. "Ugly" is the default flag for an IP record.

There are 4 flags an IP record can have:

• Good - The IP is administratively white-listed.
• Bad - The IP is administratively black-listed.
• Ugly - The IP is evaluated based on its statistics.
• Ignore - The IP is to be ignored as if it is Infrastructure.

Thus G(ood)B(ad)U(gly) database -- GBUdb.

Your GBUdb can only report on IPs that it has been exposed to. When you test an IP that your GBUdb is not tracking then it will return a "new" GBUdb record with the default Ugly flag set.

Note also in the report that the good and bad counts are zero and as a result the calculated probability of spam figure and confidence figure are also zero.

The range classification is "New" indicating the IP is new to the GBUdb node you've asked and the associated result code is zero.

When you ask GBUdb about an IP that it has had experience with then you will get other results -- primarily dependent upon the good and bad event counts and almost certainly with the "Ugly" flag set since it is the default.

You were most likely misinterpreting the flag for the range evaluation. If you want to know what GBUdb thinks about an IP summed up in a word then the range evaluation is the term you're looking for.

Also - remember that your GBUdb doesn't know about any IPs it hasn't seen before so for those IPs it will always return a "New" record. Once it has seen messages from an IP it will have recorded good and bad events and will be able to calculate a probability of spam (from -1.0 to +1.0) and a confidence (from 0.0 to 1.0).