Re: Massive SPAM Increase

[jim barchuk <jb () jbarchuk com>]

Hi Alex!

> I don't know if I'm a target of some SPAM attack or if it is just 
> business as usual.

I think it's business as usual, on new millenium designer steroids. :)

First, I must say that I *never* even glance at headers any more. I don't 
have the slightest interest or care where they came from, pro, amateur, 
cracked box, whatever.

Second, I don't keep any kinds of recorded stats on anything, so 
everything I talk about is based on constant monitoring and memory. Not 
particularly reliable for hard number documentation, but I do have a good 
feel for the general ebbs and flows.

But I do study spam *content* very intently. The purpose of course is to 
either steal or sell stuff. The stealers are the 419/ID thefts/other 
scams, and the sellers are the mortgage/pharm/porn vendors. (There are two 
other kinds, viruses/malignant email (which return no profit except to 
gain new spam broadcast machines,) and 'broken spam generators' (which are 
simply faulty software,) and although there are *tons* of faulty spam 
neither of those two are profit -generators- for the spammer so I tend to 
discount them in importance.) (And whether a particular 'sell' spam really 
is a scam in sheeps clothing is a separate but moot topic because it's 
undetectable at the email level.)

I do notice a couple of things over the past week or so.

One is, yes, a drastic *spike* to a new higher plateau in sheer volume did 
happen. I can't recall an exact date, but it did happen very suddenly. If 
I did have to pin a date on it it would be 10/2 or 10/3. Normally spammers 
'go to work' on Thursday, to hit the 'weekend surfers.' (Used to be Friday 
but they moved it up earlier this year.) But it ocurred to me one day that 
it was waaaaaay too early in the week for the usual weekend flood. And it 
wasn't just a day earlier, Wednesday, which is why I think it was Monday 
or Tuesday. Tuesday sticks in my head a little stronger but not sure.

The other thing I notice is that there was little *variation* in the 
*kinds* of spam I get. No unusual increases in bounces, (joesjobs,) or 
sellers or stealers, just a larger volume overall.

By spike --> new plateau, I mean I went from a usual 500/day to 700/800. 
50% is a *ton* more to happen so suddenly.

I *think*, (that is, an intiutive guess,) that I've seen these kinds of 
increases before. (Again, I don't keep any kinds of stats on this stuff 
that would help to objectively demonstrate a theory.) I think it happens 
generally early in the month. I *think* this happens actually for 
*business* (the business of spam) reasons. I have a feeling that the 
spammers tend to operate on a monthly cycle. They gather new orders during 
the month, and start firing off their product at the start of the next 
month. I'm guessing that it's probably simply easier to do things this 
way, different process steps in order -during- the month, rather than to 
do 'everything every day.' The weekly cycles certainly do exist, so 
there's no reason that there aren't month;y cycles too. All businesses 
work that way. Why Sept might have been a hot 'new orders' month that 
leads to hotter than average Oct volume is another story. :)

There's another possibility, that you've finally gotten into the 'millions 
of email addresses' lists that the spammers use. I sure remember when 
*that* happened to me many years ago, when spam suddenly shot from 'a 
couple' to 'dozens --> scores --> hundreds' a day. Once you're tagged as a 
'reliable addess,' eventually they put you in the From: and other header 
lines so you can collect the bounces as well as the original spam. I'm 
particularly tickled by all the instances I get of 'receive several 
bounces *before* the original spam' because that means I have a *very* 
reliable address and am -highly- -regarded- by the spam software that 
generates it. LOL!

Have a :) day!

jb

--
jim barchuk
jb () jbarchuk com

------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. 
World renowned security experts reveal tomorrow's threats today. Free of 
vendor pitches, the Briefings are designed to be pragmatic regardless of your 
security environment. Featuring 36 hands-on training courses and 10 conference 
tracks, networking opportunities with over 2,500 delegates from 40+ nations. 

http://www.blackhat.com
------------------------------------------------------------------------------