Jump to content

Most spam sender addresses start with a "q"?

Recommended Posts

Over the last weeks, I have noticed something strangish. A very large proportion (90 % or more) of the (fake) e-mail addresses behind messages that end up in my Held Mail start with the letter "q". My filters work well, I get very few false negatives and false positives.

Is it just me?

Link to comment
Share on other sites

Can't backup your claim at all.

Well, this is how my held mail looks at the moment:

[478] quovisyegp[at]sofmap.com (Tue, 3 Nov 2009 18:18:49 +0100 Preview )

Tue, 3 Nov 2009 18:18:49 +0100 (Blocked cbl.abuseat.org)

[479] quote[at]overnightnetworks.com (Tue, 3 Nov 2009 18:18:57 -0300 Preview )

Tue, 3 Nov 2009 18:18:57 -0300 (Blocked SpamAssassin=6)

[480] quotes[at]wsglass.com (??????? ??? ????. ???? ??? Preview )

Wed, 4 Nov 2009 11:40:41 +0530 (Blocked cbl.abuseat.org)

[482] quonb492[at]kewill.com (Wed, 4 Nov 2009 01:33:38 -0800 Preview )

Wed, 4 Nov 2009 01:33:38 -0800 (Blocked pbl.spamhaus.org)

[483] qunitddfig[at]vsea.com ((no subject) ID: Preview )

Wed, 4 Nov 2009 17:45:34 +0300 (Blocked cbl.abuseat.org)

[484] quovismshl[at]sofmap.com (Thu, 5 Nov 2009 03:23:50 +0800 Preview )

Thu, 5 Nov 2009 03:23:50 +0800 (Blocked xbl.spamhaus.org)

Hmmm. Maybe it is the same people behind most of the spam I get?

Link to comment
Share on other sites

...Hmmm. Maybe it is the same people behind most of the spam I get?
Definitely an unusual pattern - hope they're not working through the alphabet or next they'll get you in the Rs :P.

No, no, seriously - the originators should show if it is all the one spammer/gang - though if they're using a deployed botnet for sending it would be hard to tell (and some botnets are 'for hire' anyway, numerous spammers might use parts of one or more at any given time). From what I can see, being on a single spammer's list is no guarantee you won't get 'duplicate' spam - quite the contrary the way some of them seem to work but there's enough diversity to make it all fairly hard to tell, whichever way it is.

Anyway, if practically all of it is ending up in your Held Mail and you're reporting some or all of it then that's about as much as you can do.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Create New...