Chris Linfoot | Has spam volume really dropped?

Monday, 17. November 2008

Has spam volume really dropped?

About 5 days ago an outfit named McColo was disconnected from the Internet when the two ISPs, Hurricane Electric and Global Crossing which had been providing McColo with connectivity, both pulled the plug.

McColo was estimated by some to be the source of up to 75% of all spam.

Given that we keep detailed logging of email delivery, including rejections, such a large drop should be clearly visible in the stats for the past few days, so is it?

Short answer: Yes, but the drop is nothing like 75%

In the 5 days since McColo was shut down, mail exchangers here have handled a total of 45,439 inbound SMTP sessions and 34,196 of those sessions ended in a 5xx permanent rejection with no message being delivered. The majority of these rejections were due to blacklisting, both DNS based and local. The remaining 11,243 SMTP sessions resulted in messages being accepted and a small proportion of those were spam although most of those were trapped by post delivery filtering and not delivered to any user.

In the same period last month, mail exchangers here handled a total of 58,544 inbound SMTP sessions and 46,924 of those sessions ended in a 5xx permanent rejection with no message being delivered. 11,260 SMTP sessions resulted in messages being queued for processing and delivery.

This shows that the rate at which email is accepted for processing and delivery here has not changed significantly but that the rate at which SMTP traffic is blocked has dropped by slightly over 22% in the month.

That is a significant drop, certainly, but it may still be a little early to celebrate the end of spam.

Category: Spam miscellany
Technorati: Spam McColo

Comments :

1. Colin17/11/2008 18:59:43

YMMV: Last month we were topping 45,000 spams per day (stopped by Marshal Spam Profiler). This week, we're floating around 9,000. I welcome the relief but as you suggest, its only temporary.

2. Another postmaster17/11/2008 19:06:17

Yep, I agree that 75% were pretty optimistic but I guess it also varies whose spam we are looking at and where. There might be different pattern for some home users who have given their email address to weird companies or participated to lotteries and so on. As you know, very old email addresses and domain are also collecting more spam than a new ones

Our company daily spam average drop from 12M to 7M which is quite impressive with over 40% drop

3. Frank Paolino17/11/2008 19:22:44
Homepage: http://www.maysoft.com

I am seeing spam down over 60%. I don't believe it will last long, as the McColo people will eventually regroup. Here is a posting I did about the drop in spam:
http://blog.maysoft.org/blog.nsf/d6plinks/FPAO-7LCJSG

4. Bob Baehr18/11/2008 01:06:14
Homepage: http://www.bobbaehr.com

I am down to about 30 per day! Really!

Must be that new "Obama-Spama" that was recently installed :)

Cheers
Bob Baehr
The Unofficial Poster Child For Lotus Notes, Domino, and Lotus Foundations

5. Conrad Longmore18/11/2008 09:00:41
Homepage: http://www.dynamoo.com/

Our spam appears to be down 30%, but these figures can be misleading - our statistics only count spam sent to VALID email addresses, not the huge amount of stuff that is sent to INVALID addresses in Directory Harvesting attacks etc (which are filtered externally).. we don't get stats for that so it's hard to see the whole picture.

6. Charles Robinson18/11/2008 14:52:13
Homepage: http://www.cubert.net

At one site we're seeing a drop of nearly 60%. At another it's closer to 45%. It's still significant, and shows that there is a lot of work to be done getting hosting providers to do the right thing. The ISP's had to know what McColo was doing. Nobody uses that much bandwidth without a good reason. They turned a blind eye as long as the bills were paid.

7. Dave Harris19/11/2008 12:19:33
Homepage: http://www.wavysworld.com

We actually saw a significant upward spike for one of our customers last week, following a downward trend since early September:

920K spam against 500k the previous week, out of 2.83m and 2.39m messages (that's just with valid recipients).

Much of this may have happened before the shutdown though - Tuesday morning at the NYC site saw a peak of 25k spam per hour.

Personally I've been receiving a lot more phish over the last week or so than I have for a long time (and straight to the http://www.phishtank.com they go).

8. Daniel Lieber19/11/2008 19:47:13
Homepage: http://iiui.com

We've noticed a significant decrease in spam over the last few weeks and the last week in particular. From a record 52,000+ spam messages in one day in July to more common numbers around 9,000-11,000, the last week has averaged about 4,000 messages per day.

We are not taking any different actions due to the reduction.

9. Dave Harris24/11/2008 08:50:36
Homepage: http://www.wavysworld.com

As an update to my comment above, I just ran the last week's stats:

Spam is down even against the (downward) trend, with legitimate mail slightly up. Looks like the McColo shutdown has had a significant effect. That said, I don't doubt that it will be short-lived, with someone popping up to replace them. Nature abhors a vacuum

Unable to post a comment? Please read this for a possible explanation...