Slashdot Mirror
Where Has All My Spam Gone?
An anonymous reader writes "I have my own domain, which has its own email server, where I receive all my personal email. I've been getting about 800 emails a day, of which perhaps 20 are real. Suddenly, Sunday or Monday evening, the spam pretty much stopped. My volume of mail has plummeted to less than 100 a day, and as far as I can tell, I'm not missing any real mail — I'm still getting the email list subscriptions I'm expecting, and every time I ask someone to send me a test message, it gets through. My domain host insists that it doesn't do any spam filtering before mail gets to my inbox, and that they've changed nothing about their configuration. I run SpamAssassin on my server to mark, but not delete, spam, and download the whole mess to my home client, and I'm still seeing the occasional message tagged by SpamAssassin. But it's virtually all gone. And I haven't changed anything about my own mail configuration, or the harvestability of my site (my personal email has been harvestable for almost a decade). So what's going on? I can't believe that several major botnets would have vanished overnight. Any ideas?"
*Checks mail logs*
Yeh, you need to ask the ISP again. No sign of slowing here.
My spam has tripled over the past few days. So I'm not getting all of it, but I'm getting a chunk of it.
Cynical Idealist
And you're complaining because .... ?
My blog
Did you install Skynet 1.0?
Hey, what's that siren going off for....
And you're complaining because .... ?
No kidding. I work as a sysadmin, and as far as I'm concerned, a spam-free day is an occasion to praise my patron demon and bring Him an offering of hookers and blow, not an excuse for an "Ask Slashdot" posting.
I write sci-fi for metalheads
... just in case you desperately need to buy some cheap "medicine" :-)
When spammers took over your box, they didn't want to flood it with their own mail.
There are no loopholes. It's either legal or it's not.
Per Ars, a 100,000 machine bot net was shut down recently. http://arstechnica.com/news.ars/post/20080814-police-nab-shadow-creators-force-botnet-to-commit-suicide.html
Sorry, we've been down for maintenance and it's taking a lot longer than we originally planned. You can expect normal service to resume by next monday.
http://arstechnica.com/news.ars/post/20080814-police-nab-shadow-creators-force-botnet-to-commit-suicide.html
That may account for some of it.
Hail Eris, full of mischief...
E pluribus sanguinem
Spam Assassin is actually assassinating spam.
On another note, has anyone heard from cousin who is a Nigerian prince? He hasn't called in days and we're beginning to get worried.....
import system.cool.Sig;
... to save the health of the athletes.
...and the Chinese are busy watching 13-year olds win gold metals. Bob
We're happy to help you solve this mystery.
What is your email address?
Okay, here's the thing: nobody but you ever got spam. We all just thought it would be funny to fool you into thinking there was some kind of worldwide scamming epidemic. You don't seriously think people would be stupid enough to buy pills off strangers who email them out of the blue, do you? I thought we'd gone a bit too far and stretched the limits of credibility when we came up with the idea for the Nigerian scams, but I was wrong, you even fell for that! Nobody is stupid enough to send all their money to a "Nigerian prince".
Anyway, enough's enough. The joke's stale now, so we decided to stop sending it all to you.
Bogtha Bogtha Bogtha
A large chunk of spam comes from a very small group of spammers. It may just be that you are only targeted by one of them, and he took a break recently.
Hang in there... he'll come back from vacation soon, and you'll be able to mortgage your penis to Nigeria again.
I'm holding it for ransom. You can have it back for $1,000,000.
Were the missing spam-mails mostly in Dutch?
http://arstechnica.com/news.ars/post/20080814-police-nab-shadow-creators-force-botnet-to-commit-suicide.html
"Shadow appears to have been mostly confined to the Netherlands, as the messages and phishing hooks were all sent in Dutch, but had apparently infected some US systems as well, as the FBI is credited for assisting on the case."
...
"Once Shadow was secured, the police contacted Kaspersky Labs about providing a means to neutralize the malware."
I run a web hosting company and over the past couple weeks I've had a few customers report that the amount of spam has dropped. Of course, they thought that this was something wrong, but I couldn't find any evidence of increased failures, it was just that there was slightly less mail coming in.
We provide a spam filtering service, and our volume hasn't really changed much in the past week or two so perhaps whichever botnet was sending you all the trash went offline or just... stopped sending to you.
ImagePut - Free, Simple, Fast Image Hosting
http://it.slashdot.org/article.pl?sid=08/08/12/191255&from=rss
http://bits.blogs.nytimes.com/2008/08/11/georgia-takes-a-beating-in-the-cyberwar-with-russia/
When the crisis abates, I expect the botnets will be returned to their regularly scheduled duties. Quite a versatile tool those botnets -- pimping V!agr4, collapsing government sites, enhancing the male doodad, distributing pr0n, bullying your neighbors (http://news.bbc.co.uk/2/hi/europe/6665145.stm). For the cost of one M1A1 tank tread, Putin bought himself a whole lot of firepower.
Advantage: Putin.
Without seeing your logs, most folks would be guessing. They symptoms you provide are not enough to make an educated guess. I would say to bump up the verbosity of your email server, SpamAssassin, and the system itself and then go from there.
There are no loopholes. It's either legal or it's not.
When Slashdot has a real slow news day
Tell me where my spam's gone
When Nigeria no longer needs me
Tell me where my spam's gone
When trojan horse avoid my inbox
Tell me where my spam's gone
When penis pumps cease their pumping
Tell me where my spam's gone
When free porn streaming doesn't bug me
Tell me where my spam's gone
When people install virus checkers
Tell me where my spam's gone
We've been seeing botnets changing desktop background to an image alerting people that they are infected with a virus. Obviously a real spam botnet operator would not alert people like that.
My theory is that some grayhat wrested control of a major botnet, and is shutting it down from the source (and alerting the victims in the process).
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Dear Sir,
We humbly apologize for the interruption in service. Please reply with your email address and our technical staff will get back to you.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Naw, just that the Russians have shifted all their botnets' attacks toward Georgia.
they need the botnet resources for ddosing georgia
The sad thing is, you might be right...
No, no, no...
Im in ur mailserverz, eating ur spam!
People replying to my sig annoy me. That's why I change it all the time.
Maybe you could forward some spam from, say, a gmail account to your address in question. If it doesn't make it through to your server then you have a definitive record to confront your ISP with. Or, if they do get through, maybe you should buy a lottery ticket because your the luckiest admin on slashdot!
In a 24 hour period we've gone from a peak of about 75,000 messages at 9pm CST last night to a low of 40,000 messages incoming today, 97.3% of which are spam. Total for the last 24 hours on that single Ironport (we have 4 in production and one in the lab) is 1.4 Million attempted messages, of which 36.1 thousand were clean.
So all things taken into consideration, consider yourself fortunate. We're still seeing a trend that indicates that over 97% of all incoming mail is garbage.
-Phil
To avoid corruption, one must remain dishonest.
It's not too-well publicized, but the Russian Business Network (AKA spammer filth) have been using (renting?) a large chunk of their botnet space to attack Georgia. Here's a bit of detail.
Maybe they just didn't have enough bandwidth to spam the planet AND take down Georgia's systems through a DOS.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
They all just got back from Black Hat / Defcon, and they're still hung over.
I find your lack of spam disturbing ...
... can mean only one thing: INVASION.
Most spam is sent by bot-nets, mostly composed by infected pc of workplaces, school and private homes. In many countries during the second and third week of August many schools and workplaces are closed so their pc are just turned off, this mean that the bot-nets have less active nodes and so are less effective. I do receive less spam too but I think that it will be back to the sad old amount at the end of the summer :(
Unluckily Murphy was right.
I've just checked my work's logs (an ISP). The number of hits in the spam taggers fell from 12/sec to 3/sec earlier this week.
So either we're identifying less spam, or there is in fact less of it.
Are you sure your server didn't switch to spam, egg, sausage and spam mode? That's not got much spam in it.
Of course I didn't RTFA... why would I do that? You really are new here aren't you? Don't let my UID fool you.
Seriously though ... if spammers started turning up dead where would the police even begin their investigation? There's only a pool of what, half a billion suspects?
Spammers and virus writers employed by spammers to create their zombie pools have been turning up dead for almost two years now.
well the first thing that scully would ask is ?
where is the scientific evidence....
so the serious question its nice that your spam level dropped but where/ip was it all coming from in the first place ?
regards
John Jones
http://www.johnjones.me.uk
1. If you've made no configuration changes or patches in the past week, that pretty much lets out program error.
2. If your ISP is saying they don't do spam filtering, then that pretty much lets that out too, unless your ISP is given to lying to you.
3. Others point to the cyber war between Georga and Russia. I'd think that those folks would have their own bots not associated with spamming, but I can't prove that.
4. It surpasses hope that all the sudden people cleaned up their pwon3d systems.
5. My spam levels have not dropped appreciably, and I not only have my own domain, but allocations as well.
6. I have noticed at times in the past that my spam levels do drop by 60, 70, even 80%. They always pick back up before too long. Enjoy a breif respite.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.