BP

I got to this page from an old Crypto-Gram I had missed.

As it happens the company I work for is a Postini customer who at ~2Bn emails a day see quite a bit of traffic. Personally I think that you are incorrect with your assessment. Postini’s Connection Manager heuristics suggest that most spam comes from Botnets which are of course available for hire, and this puts a step between the spammer and the source of their spam.

Botnets vary in size, and there is now competition between the Botnets. So my hypothesis is that the are a relativey small number of the large Botnets, and its the large botnets that send most of the spam. Each Botnet has a different spam traffic pattern, and is in essence a wave. So if you get say 5 waves at the same time, wave dynamics apply and large variances are inevitable, as are quiet periods.

Just my 2p worth.

Cheers

BP

On the assumption that you are atleast partialy correct in your view (and I see no real false indicators) then going after the few would be a worthwhile investment in resources.

However once one Major Spammer has had their head put on a pole and paraded around what is the chance of catching more?

I am assuming (like you are) that the spammers are not particularly stupid people therefore it will be interesting to see if and when the Major few change their tactics to cover their tracks a little more.

After all, we want a few of them to live and tell their tales, for the encouragement of the others….

Oh, and as a calling card? Leave a few dozen FIJA pamphlets, which would make a great poison pen in case Mister Spammer ever decided to track down his assailants…

The “authorities” are too busy sucking on the public tit.

In particular there’s no evidence that spammers, in the main anyway, work out where domain MX records point. For if they did, MessageLabs would report very low percentages of spam as spammers didn’t waste their time trying to get material through their filters… but that’s not what they see.

However, it is indeed possible that there’s thousands of spam gangs each targetting a handful of ISPs each — you’d see the same graph at Demon, but you’d see all sorts of other indications that this was the case as well (such as spam filtering systems having to be customised on a per-ISP basis), and I can’t name any such evidence.

… I feel that the swings are more likely to be caused by a few large-scale spammers, than by some general factor (phase of the moon or whatever) that is causing many small spammers to behave the same way.

Of course this argument doesn’t count the spammers or identify their targets when they aren’t hitting Demon (maybe they just take days off?) but if you look at your inbox (especially the non-filtered version of it) then you can see a lot of repetition in the spam that arrives and what it advertises… my graph is not the only evdence for my proposition! but it is, in my view, striking corroboration.

Finally, it’s a mistake to view spammers as foolish or mad — they seem to me to be quite successful and inventive manipulators of the systems they encounter

Let me put it another way: I feel your graph clearly shows a correlation with phases of the moon, therefore conclusively proving that all spammers are in fact loonies.

Kind regards,
Gary