Over the last weeks, I have noticed something strangish. A very large proportion (90 % or more) of the (fake) e-mail addresses behind messages that end up in my Held Mail start with the letter "q". My filters work well, I get very few false negatives and false positives.
Is it just me?
Full Version: Most spam sender addresses start with a "q"?
Can't backup your claim at all.
QUOTE(Wazoo @ Nov 3 2009, 10:23 PM) 
Can't backup your claim at all.
Well, this is how my held mail looks at the moment:
QUOTE
[478] quovisyegp[at]sofmap.com (Tue, 3 Nov 2009 18:18:49 +0100 Preview )
Tue, 3 Nov 2009 18:18:49 +0100 (Blocked cbl.abuseat.org)
[479] quote[at]overnightnetworks.com (Tue, 3 Nov 2009 18:18:57 -0300 Preview )
Tue, 3 Nov 2009 18:18:57 -0300 (Blocked SpamAssassin=6)
[480] quotes[at]wsglass.com (??????? ??? ????. ???? ??? Preview )
Wed, 4 Nov 2009 11:40:41 +0530 (Blocked cbl.abuseat.org)
[482] quonb492[at]kewill.com (Wed, 4 Nov 2009 01:33:38 -0800 Preview )
Wed, 4 Nov 2009 01:33:38 -0800 (Blocked pbl.spamhaus.org)
[483] qunitddfig[at]vsea.com ((no subject) ID: Preview )
Wed, 4 Nov 2009 17:45:34 +0300 (Blocked cbl.abuseat.org)
[484] quovismshl[at]sofmap.com (Thu, 5 Nov 2009 03:23:50 +0800 Preview )
Thu, 5 Nov 2009 03:23:50 +0800 (Blocked xbl.spamhaus.org)
Tue, 3 Nov 2009 18:18:49 +0100 (Blocked cbl.abuseat.org)
[479] quote[at]overnightnetworks.com (Tue, 3 Nov 2009 18:18:57 -0300 Preview )
Tue, 3 Nov 2009 18:18:57 -0300 (Blocked SpamAssassin=6)
[480] quotes[at]wsglass.com (??????? ??? ????. ???? ??? Preview )
Wed, 4 Nov 2009 11:40:41 +0530 (Blocked cbl.abuseat.org)
[482] quonb492[at]kewill.com (Wed, 4 Nov 2009 01:33:38 -0800 Preview )
Wed, 4 Nov 2009 01:33:38 -0800 (Blocked pbl.spamhaus.org)
[483] qunitddfig[at]vsea.com ((no subject) ID: Preview )
Wed, 4 Nov 2009 17:45:34 +0300 (Blocked cbl.abuseat.org)
[484] quovismshl[at]sofmap.com (Thu, 5 Nov 2009 03:23:50 +0800 Preview )
Thu, 5 Nov 2009 03:23:50 +0800 (Blocked xbl.spamhaus.org)
Hmmm. Maybe it is the same people behind most of the spam I get?
QUOTE(blazius @ Nov 5 2009, 04:02 AM)
...Hmmm. Maybe it is the same people behind most of the spam I get?
Definitely an unusual pattern - hope they're not working through the alphabet or next they'll get you in the Rs 
. No, no, seriously - the originators should show if it is all the one spammer/gang - though if they're using a deployed botnet for sending it would be hard to tell (and some botnets are 'for hire' anyway, numerous spammers might use parts of one or more at any given time). From what I can see, being on a single spammer's list is no guarantee you won't get 'duplicate' spam - quite the contrary the way some of them seem to work but there's enough diversity to make it all fairly hard to tell, whichever way it is.
Anyway, if practically all of it is ending up in your Held Mail and you're reporting some or all of it then that's about as much as you can do.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.