Jump to content

Could the spam graph be made to work?


Recommended Posts

As a fully paid-up card-carrying afficionado of the spam graphs, nowadays I sometimes succumb to the (conspiracy) theory that they are now being fed some program making up random numbers, that interjects little wiggles every now and then in an effort not to be blatantly bogus.

However, since it's fun, lets speculate about what we see. Seemingly, in the second week of January, some fiend or fiends somewhere turned an unrelenting high-pressure jet of spam on Spamcop's users and honey-pots. This looks like nothing I have seen before in something like a decade of staring at the sacred graphs. Usually, the fiends blast the stuff out in huge short-lived bursts, presumably in an effort to hit the world's mailboxes before the blocking lists catch up. Coinciding with this great new deluge, the amount of spam that actually makes it to my "held mail" has dropped to almost nothing. What's going on?

Over time, I've noticed that the fiends and cockroaches have become much more interested in trying to plant malware on my computers, whereas before, they wanted to sell me bling, and potions to make my penis bigger. Clearly, the world of the cockroach is evolving. The spammers are becoming more industrialised, more professional, and more focused on what actually makes money. Amazingly, some of them have even learned how to spell!

I'd be really interested to read anybody else's speculations, even if they're no more informed than my own.

Link to comment
Share on other sites

I can't pretend any special knowledge but the current return to something like the historical rates of spam processing shown began back in September last, with the even higher level (but still within historical levels) and strange uniformity happening in January, as you say - but with little or no change in the ISP reports sent. There was a time when well over 3 million spam a day were processed (well over a billion a year). See

http://web.archive.org/web/20101129143011/....shtml?spamyear (the year as at Nov 29 2010) and I seem to recall higher annual rates than that.

Global spam levels always fluctuate, it is perhaps more volatile now than in "the old days" and there was, indeed, a bit of an uptick around October-November according to http://www.senderbase.org/static/spam/ (select "Global Volume" and "Last 6 Months"). But that doesn't explain the increase in the SC spam stats (select "Last 18 Months" of the foregoing, showing even greater spam over an earlier period encompassing some apparently depressed SC processing performance). Of course SenderBase and SpamCop may be seeing different "samples" but that doesn't explain the ISP reports being fairly-much unchanged throughout.

No, as said before, I think it more likely that the way the stats are gathered might have changed, perhaps some resource hidden in recent times (and which isn't reporters like you and me) being exposed again. As it has long said about the graphs in http://www.spamcop.net/spamstats.shtml, "This data reflects more about SpamCop's usage patterns than it does about the spam. These numbers now reflect only a small fraction of total spam being processed by SpamCop, ..."

No doubt something could be learned about relative reporter:spamtrap detections (which might falsify the "resurgent dark resource" hypothesis) from the "Ð…pam in progress" and/or from drilling down in the "Browseable map of IPv4 netspace" from that SC stats page and integrating that with the "Report history" on selected IP addresses available to reporters with processing credits but I don't propose to set that out in detail or even follow through on it myself. Part of the "game" is to deny spammers (and a few of them seem to come to these forums) any comfort or clues as to how to improve their returns. Anyway, those details might also be "frozen" for all I know.

Link to comment
Share on other sites

  • 3 weeks later...

Seeing a sizeable gap in the chart right now - but the reporting system seems to be down for me at the moment so that would explain it, if that is general. If same for others, can somebody flag it in the "Reporting help" forum? Struggling with an IPad at the moment, "swimming in treacle" etc.

[Edit] My mistake, parser is working fine, assume whole reporting system is too, therefore it is just the display. Sending e-mail to support.

- done, Case 55402

Link to comment
Share on other sites

  • 2 months later...


This topic is now archived and is closed to further replies.

  • Create New...