Drop in reporting, Spammers take the night off? Options

[showker]

See: http://www.knujon.com/news -- two major spam hosts closed down. Won't last long, but we're running about 30% of our normal flow. Also see http://www.hostexploit.com/ for their latest take-down report.

Enjoy it while it lasts.

ICANN is rewriting their AAC regulating registrars -- everyone is urged to write them with this info:

http://www.safenetting.com/

[Miss Betsy]

Thanks for the information! I have submitted a comment.

Miss Betsy

[Farelf]

No doubt it is temporary (but dare to hope otherwise) - I note the redirection botnet-hosted sites like rlka.vhweaker.cn are really struggling to resolve today ('Canadian' pharmacy, counterfeit watches, etc.) and they are also "not whoisable". Practically all the spam I am seeing just now is more than usually pointless - the payloads are inoperable links. Haven't checked any of the the sites they are meant to/used to redirect to.

[Geek]

Looks like the botnets are rebuilt enough to be functional ... I just received more spam in the last 8 hours than in the past two weeks combined and it's just continuously pouring in right now!!!!! (IMG:style_emoticons/default/ohmy.gif)

[Farelf]

...Looks like the botnets are rebuilt enough to be functional ... I just received more spam in the last 8 hours than in the past two weeks combined and it's just continuously pouring in right now!!!!! (IMG:style_emoticons/default/ohmy.gif)

Bad news - those not yet affected are just in the eye of the storm then.

Still seeing DNS problems in reaching the redirector links though. For those 1/12,000,000 fools clicking, they're going nowhere, going by the stuff that gets through to me.

[Farelf]

Ѕpam stats may be showing the beginnings of the restoration to previous levels. If that proves too protracted, if there are those who miss their daily spam, here is The Verge of Meaning: A Small Anthology of spam Poetry

No, no, don't thank me.

[Geek]

Who'dda thought spam would spawn a legit industry - spam poetry (IMG:style_emoticons/default/laugh.gif)

[Farelf]

Who'dda thought spam would spawn a legit industry - spam poetry (IMG:style_emoticons/default/laugh.gif)

I'm reasonably certain spammers themselves would be recyclable, the only real question to my mind being the amount of processing required. Composting would be the most energy-efficient but the little devils keep climbing out of the bin. {sigh} Plan B ... shredding first, check the decibel levels, etc., etc.

Sure enough, I too seem to be back to 'normal' spam levels. The Chinese-registered, botnet-hosted redirectors are resolving just fine now though.

[Lking]

The zombies are coming back!

Washington Post artical

FireEye report on how they got control of the botnet again.

[rconner]

The zombies are coming back!

The SpamCop monthly graph seems to bear this out -- week 47 rate has gone up by about 50% over the very quiet week 46.

I couldn't say what the impact is in my own case, I let my ISP filter most of mine out before it goes to SpamCop or my computer.

-- rick

[Lking]

I must be on some weird lists. My overnight spam load has doubled 100-200 vs 50-100 for the last two weeks, with about 1/2 the increase in cyrillic.

The lull lasted longer than I would have guessed.

This post has been edited by Lking: Nov 27 2008, 09:12 AM

[Geek]

Yup! I had an increase yesterday and today a HUGE jump in spam.

You'd think ICANN would not allow automated, bulk domain registrations for just for this reason.

[Farelf]

...You'd think ICANN would not allow automated, bulk domain registrations for just for this reason.

Definitely reason to feel more sanguinary than sanguine about the whole thing. But then M$'s live.com is being used for the same purposes (redirection) as the botnetted Chinese 'alphabet soup' domains and in considerable volume from what I can see, even more cause to be aggrieved about that. Apparently microsoft.com made it to #5 in the SpamHaus top 10 list of dreadful ISPs yesterday-day before but by the time I looked they weren't even in the top ten anymore. All a dreadful mistake or some re-arrangement of deckchairs? The internet continues to founder in the same old sea of spam.

But yeah, it was nice while the botnets were down. Just hope the goodguys learned more about beating them than the bothearders learned about recovery (for next time).

[michaelanglo]

I must be on some weird lists. My overnight spam load has doubled 100-200 vs 50-100 for the last two weeks, with about 1/2 the increase in cyrillic.

The lull lasted longer than I would have guessed.

Same but different here with the lull starting 8 November with a drop from 180/d to 130/d and cyrillic spam way down and remaining that way.

From 18 November and currently 120/d.

[dra007]

The drop has been consistent a few weeks now, I will keep my fingers crossed. Seems for the most part I am pestered by a Russian spammer who is pretty bullet proof. I also saw an increase in spam rallied via Turkey server at the expense of south American and Korean spam. The Japanese spam has dropped to near 0. Hard to tell who the real spammers are without doing further research but the trends I see are consistent and considerable.

[Farelf]

The stats are showing things are returning to 'spam normal' with the Srizbi botnet's reactivation. The sophistication of that operation's built-in contingency planning is breathtaking (noted various places, including):
Srizbi Botnet: Life after McColo (thanks for the link vark).

In any even, the botnet's operations are not exactly as they were - yesterday was far lower than usual for me, after days of having bounced back to pre-shutdown levels. ISP filtering comes into the equation, making it hard to guess all that is happening.

[Geek]

My forum spam is going through the roof and yet the IP board only showed Googlebot and MSN.... here's an interesting story that may explain that:

http://boycottnovell.com/2008/12/02/microsoft-bot-cracked/

I popped one of the IP's into Google and it seems to confirm forum *posts*, not just spidering :confused:

[DavidT]

That "story" (blog post) is pretty weak and misleading....read the first comment below it....the author thinks that Windows runs on mainframes. (IMG:style_emoticons/default/blink.gif)

I googled some of the IPs and didn't come up with posts...just a lot of stat logs.

DT

[Geek]

Hi,

The IP was from my IP panel at the time. WHOIS pointed it to MSN bot and I popped it into Google and found over 600 results, including the honeypot project, stopforumspam and the first two hits were that article.

Cheers!

[Farelf]

More on "the resumption of normal service" at http://www.theregister.co.uk/2009/01/26/spam_trends/