Re: there aren't that many serious spammers any more?

["Dr. Neal Krawetz" <hf () hackerfactor com>]

On Mon Apr  9 07:33:40 2007, John LaCour wrote:
> Richard Clayton posts on the Univ of Cambridge Blog about his analysis
> of Demon Internet spam traffic vs. non-spam traffic and concludes that
> most spam comes from a few gangs.
>
> Interesting article here:
> http://www.lightbluetouchpaper.org/2007/04/03/there-arent-that-many-serious-spammers-any-more/

That's exactly what I'm seeing, too.
There may be more spam today, but it is being sent by far fewer spam
groups.  (Fewer groups, but they are more active.)

What they didn't point out: most of the emails are directed.
If you capture their mailing lists, you will see that they are clustered
in groups.  They may focus on domains or services, but spam is usually
targeted today.  My honeypot in the US receives very little non-English
spam, and my account in Asia gets lots of asian spam.

The large bursts that they are measuring are probably due to directed
mailing lists.  (Many groups cycle mailing lists and don't use the same 
list every day.)

                                        -Neal
--
Neal Krawetz, Ph.D.
Hacker Factor Solutions
http://www.hackerfactor.com/
Author of "Introduction to Network Security" (Charles River Media, 2006)
and "Hacking Ubuntu" (Wiley, 2007)

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.