Unmanned Spam?

The mail run at 12:00 (noon) and 14:00 had a 100% trapping, indicating an error in the first filter. The sole word "com" had made it in. The, perhaps, unseen enlightenment is the "100% trapping". "com" was in 100% of the mail. That is to say, which "com"? My domain, or their spam? If so, can I do something with this. If so, it is not clear.

21:18 - Noting: the last two mailruns are of low volume (161 & 170)

tc

Small correction

While the volume is large, it appears the spammers are working through their stockpile of old domainnames. Maybe they are on vaction.

tc

Volume up, but no tricks

It's not clear what is going on. Currently, spam volume is normal, but the pace is erratic. (As an example, one batch may have 300, the next 125.) In addition, it looks like domain names are being thrown out. There is no evidence of hiding the payload by any kind of encoding; just straight plain HTML in most cases. Even URL wrapping has been abandoned.

tc

First note on back to normal

I've noted over the last few days many reports that things have reverted with spam and all things have return to normal (so to speak). The break was nice, but now I can report the volume is back and the tricks remain the same. Just enough to be out of the range of automation.

tc

Volume picking up.

After a major slow down in spam, today marks the second day of spam volume picking up. Notabley, there is very few tricks in the incoming mail. There is a lot of domain dumping. I have noted as many as 8 domains in a single email, but usually 3 to 4. Alot of .com and .cn continue. ".es" which was heavy for the last two weeks is now rolling back. Similarly, ".eu" which as heavy for two weeks is now almost unseen.

tc