Introduction
This is an analysis of spam received at a set of spam traps during the week of Monday December 8th 2003 (ISO week number 50, from Monday December 8th 2003 to Sunday December 14th 2003 inclusive). Most of the spam traps are expired or non-existent accounts, the remaining few have been unused for a long time with no legitimate email traffic. All the expired addresses have been bouncing mail for over a year, most for more then three. None of the spam traps have been actively seeded to receive spam. For the purpose of this report, spam is defined as any message delivered to these spam traps. All times and dates are relative to UTC.
While it is impossible to say with any level of certainty how representative these numbers are of spam in general, I believe they are close enough to provide useful information to anyone interested in spam or spam prevention.
Summary
A short summary of this weeks numbers.
- Total number of messages:
- 1561
- Unique message bodies:
- 1505
- Unique sender IP addresses:
- 1357
- Average message size:
- 3651
Client DNS
Reverse DNS
The client IP address is looked up in DNS at the time of delivery. The following shows the number of clients with and without published reverse DNS information, and the number of clients with matching forward and reverse DNS information.
- Clients without reverse DNS:
- 318 (20.4%)
- Clients with reverse DNS:
- 1243 (79.6%)
- Clients with matching forward and reverse DNS:
- 1134 (72.6%)
Originating Domain
The 10 most frequent domains (reverse excluding the host name/left most label). Only clients with matching forward and reverse DNS information are considered. Count is the number of messages delivered from clients within the given domain. Percentage is relative to the number of messages delivered from clients with matching forward and reverse DNS information.
| Domain | Count | Percentage |
|---|---|---|
| client.comcast.net | 44 | 3.9% |
| attheblue.com | 32 | 2.8% |
| dyn.optonline.net | 29 | 2.6% |
| dip.t-dialin.net | 24 | 2.1% |
| prod-infinitum.com.mx | 22 | 1.9% |
| true-bargains.net | 18 | 1.6% |
| ne.client2.attbi.com | 16 | 1.4% |
| client.mchsi.com | 15 | 1.3% |
| cpe.net.cable.rogers.com | 13 | 1.1% |
| client.attbi.com | 11 | 1% |
Client Countries
Client Country Distribution
Client country is determined using the WebHosting.Info ip-to-country data. Data is updated monthly if there are updates available. This shows the top 15 countries for delivering clients. Count is the number of messages delivered from clients in the given country. Percentage is relative to the total number of messages received in the reporting period.
| Contry | Count | Percentage |
|---|---|---|
| United States | 919 | 58.9% |
| Canada | 90 | 5.8% |
| China | 81 | 5.2% |
| Republic Of Korea | 75 | 4.8% |
| Brazil | 44 | 2.8% |
| Germany | 34 | 2.2% |
| United Kingdom | 30 | 1.9% |
| Netherlands | 27 | 1.7% |
| Mexico | 27 | 1.7% |
| France | 18 | 1.2% |
| Sweden | 16 | 1% |
| Poland | 14 | 0.9% |
| Spain | 14 | 0.9% |
| Japan | 13 | 0.8% |
| Austria | 12 | 0.8% |
Senders
Claimed Sender Domains
Domain name claimed in envelope sender addresses. It is commonly accepted that a significant share of all spam is sent with a forged sender address, so the following list is useless for identifying message origin. It is included here to show spammers domain preference when forging sender addresses.
| Domain | Count | Percentage |
|---|---|---|
| yahoo.com | 127 | 8.1% |
| msn.com | 46 | 2.9% |
| hotmail.com | 41 | 2.6% |
| aol.com | 30 | 1.9% |
| earthlink.net | 20 | 1.3% |
| SB1.trbrgns.com | 18 | 1.2% |
| swordfishmedia.biz | 17 | 1.1% |
| hgfhcvvg.com | 14 | 0.9% |
| mailcity.com | 12 | 0.8% |
| excite.com | 10 | 0.6% |
Clients
A port scan is performed on all clients delivering messages to spam traps. The scan is started as soon as possible after message delivery, usually within a few seconds.
Please note that in cases where the client is located behind a router or firewall doing NAT, the target of the scan may be the router/firewall not the sending client.
Services On Unfiltered Ports
Services are identified by nmaps version detection feature. The following lists the 15 most common services found on unfiltered ports. The count is the number of distinct IP addresses, the percentage is relative to the total number of distinct IP addresses seen within the reporting period.
| Service | Count | Percentage |
|---|---|---|
| Microsoft Windows msrpc | 668 | 49.2% |
| Microsoft Windows UPnP | 443 | 32.6% |
| Microsoft Windows XP microsoft-ds | 192 | 14.1% |
| Apache httpd | 127 | 9.4% |
| Microsoft mstask | 102 | 7.5% |
| OpenSSH | 98 | 7.2% |
| Microsoft IIS webserver | 87 | 6.4% |
| Microsoft Distributed Transaction Coordinator | 70 | 5.2% |
| Microsoft Terminal Service | 68 | 5% |
| Sendmail smtpd | 60 | 4.4% |
| Microsoft ESMTP | 51 | 3.8% |
| Microsoft DNS | 49 | 3.6% |
| KaZaA client | 42 | 3.1% |
| Microsoft ftpd | 37 | 2.7% |
| MySQL | 32 | 2.4% |
Client OS Vendor
Client operating systems are identified by nmaps TCP/IP fingerprinting feature. The following lists the 10 most common client operating system vendors. In cases where TCP/IP fingerprinting did not successfully identify the clients operating systems, it is listed as *unknown*.
| Vendor | Count | Percentage |
|---|---|---|
| Microsoft | 836 | 61.6% |
| *unknown* | 246 | 18.1% |
| Linux | 126 | 9.3% |
| FreeBSD | 77 | 5.7% |
| Cisco | 16 | 1.2% |
| Turtle | 13 | 1% |
| IBM | 11 | 0.8% |
| Cnet | 5 | 0.4% |
| Smoothwall | 4 | 0.3% |
| Apple | 3 | 0.2% |
Time Distribution
Day of Week
Distribution of messages over days of week. The count shows the number of messages received on each day, the percentage is relative to the total number of messages received within the reporting period.
| Day | Count | Percentage |
|---|---|---|
| Mon | 203 | 13% |
| Tue | 246 | 15.8% |
| Wed | 238 | 15.2% |
| Thu | 239 | 15.3% |
| Fri | 220 | 14.1% |
| Sat | 218 | 14% |
| Sun | 197 | 12.6% |
Time of Day
Distribution of messages over time of day. 00 describes the hour from 00:00 to 01:00. The count shows the number of messages received within each hour, the percentage is relative to the total number of messages received within the reporting period.
| Hour | Count | Percentage |
|---|---|---|
| 00 | 77 | 4.9% |
| 01 | 66 | 4.2% |
| 02 | 75 | 4.8% |
| 03 | 75 | 4.8% |
| 04 | 66 | 4.2% |
| 05 | 61 | 3.9% |
| 06 | 56 | 3.6% |
| 07 | 57 | 3.7% |
| 08 | 53 | 3.4% |
| 09 | 45 | 2.9% |
| 10 | 53 | 3.4% |
| 11 | 56 | 3.6% |
| Hour | Count | Percentage |
|---|---|---|
| 12 | 56 | 3.6% |
| 13 | 56 | 3.6% |
| 14 | 57 | 3.7% |
| 15 | 66 | 4.2% |
| 16 | 54 | 3.5% |
| 17 | 66 | 4.2% |
| 18 | 75 | 4.8% |
| 19 | 74 | 4.7% |
| 20 | 87 | 5.6% |
| 21 | 80 | 5.1% |
| 22 | 81 | 5.2% |
| 23 | 69 | 4.4% |
Size Distribution
Message Size Distribution
Message size distribution over all messages. Count is the number of messages within the given size range. The percentage is relative to the total number of messages received within the reporting period.
| Size | Count | Percentage |
|---|---|---|
| 2.5KiB > size >= 1.5KiB | 418 | 26.8% |
| 1.5KiB > size >= 0.5KiB | 359 | 23% |
| 3.5KiB > size >= 2.5KiB | 273 | 17.5% |
| 4.5KiB > size >= 3.5KiB | 200 | 12.8% |
| 5.5KiB > size >= 4.5KiB | 94 | 6% |
| 6.5KiB > size >= 5.5KiB | 63 | 4% |
| 7.5KiB > size >= 6.5KiB | 37 | 2.4% |
| 8.5KiB > size >= 7.5KiB | 26 | 1.7% |
| 10.5KiB > size >= 9.5KiB | 16 | 1% |
| 9.5KiB > size >= 8.5KiB | 15 | 1% |
DNS Block Lists
These numbers shows the presence of the sending client in a DNS block list at the time of message delivery. The selection of DNS block lists may be updated on a monthly basis.
Senders In DNS Block Lists
Sending clients present in DNS block list at the time of delivery. The count is the total number of messages delivered from clients listed in the respective block list. The percentage is relative to the total number of messages received within the reporting period.
| DNS block list | Count | Percentage |
|---|---|---|
| bl.spamcop.net | 1246 | 79.8% |
| cbl.abuseat.org | 719 | 46.1% |
| dul.dnsbl.sorbs.net | 709 | 45.4% |
| sbl.spamhaus.org | 302 | 19.3% |
| socks.dnsbl.sorbs.net | 235 | 15.1% |
| http.dnsbl.sorbs.net | 196 | 12.6% |
| spam.dnsbl.sorbs.net | 134 | 8.6% |
| relays.visi.com | 129 | 8.3% |
| misc.dnsbl.sorbs.net | 37 | 2.4% |
| zombie.dnsbl.sorbs.net | 25 | 1.6% |
| relays.ordb.org | 15 | 1% |
| smtp.dnsbl.sorbs.net | 2 | 0.1% |
DNS Block List Groups
To investigate overlap of the different DNS block lists and the effectiveness of combinations of block lists, the following shows the number of messages delivered from clients listed in at least one of the groups block lists. The set of groups may be updated on a monthly basis.
- all:
- 1464 of 1561 (93.8%)
- bl.spamcop.net, cbl.abuseat.org and dul.dnsbl.sorbs.net:
- 1399 of 1561 (89.6%)
- bl.spamcop.net and dul.dnsbl.sorbs.net:
- 1375 of 1561 (88.1%)
- bl.spamcop.net and cbl.abuseat.org:
- 1299 of 1561 (83.2%)
- *.dnsbl.sorbs.net:
- 993 of 1561 (63.6%)
SpamAssassin
All messages are filtered through SpamAssassin and reports are generated on hit rates including and excluding Bayesian classification as well as the scores from the Bayesian classifier itself. As the spam traps receive no legitimate email, the learning for the SpamAssassin Bayesian classifier is based on mail received at a different address. This can be expected to reduce the accuracy of the numbers that includes the result of the Bayesian classifier.
SpamAssassin Without Bayesian Classifier
SpamAssassin hits when disregarding the result of the Bayesian classifier. The countis the number of messages for the given score range. The percentage is relative to thetotal number of messages received within the reporting period.
| Hits | Count | Percentage |
|---|---|---|
| 0 > hits | 3 | 0.2% |
| 5 > hits >= 0 | 452 | 29% |
| 10 > hits >= 5 | 384 | 24.6% |
| 15 > hits >= 10 | 285 | 18.3% |
| 20 > hits >= 15 | 220 | 14.1% |
| hits >= 20 | 217 | 13.9% |
SpamAssassin Bayesian Classifier Scores
The score of the SpamAssassin Bayesian classifier. The count is the number of messages for the given score range. The percentage is relative to the total number of messages received within the reporting period.
| Score | Count | Percentage |
|---|---|---|
| 1.00 > score >= 0.95 | 1370 | 87.8% |
| 0.95 > score >= 0.85 | 58 | 3.7% |
| 0.85 > score >= 0.75 | 28 | 1.8% |
| 0.75 > score >= 0.65 | 12 | 0.8% |
| 0.65 > score >= 0.55 | 30 | 1.9% |
| 0.55 > score >= 0.45 | 59 | 3.8% |
| 0.45 > score >= 0.35 | 3 | 0.2% |
| 0.35 > score >= 0.25 | 1 | 0.1% |
SpamAssassin Including Bayesian Classifier
SpamAssassin hits including the result of the Bayesian classifier. The count is the number of messages for the given hit range. The percentage is relative to the total number of messages received within the reporting period.
| Hits | Count | Percentage |
|---|---|---|
| 0 > hits | 1 | 0.1% |
| 5 > hits >= 0 | 98 | 6.3% |
| 10 > hits >= 5 | 389 | 24.9% |
| 15 > hits >= 10 | 335 | 21.5% |
| 20 > hits >= 15 | 228 | 14.6% |
| hits >= 20 | 510 | 32.7% |
Distributed Checksum Clearinghouse
Number of matches for the three matching algorithms used by DCC. The DCC servers are queried at the time of delivery. The Body, Fuz1 and Fuz2 columns shows the number of messages matched in the count range for their respective algorithm. The Highest column shows the number of hits from the algorithm returning the highest match count. The percentage is relative to the total number of messages received within the reporting period.
| Range | Body | Fuz1 | Fuz2 | Highest |
|---|---|---|---|---|
| 25 >= count | 1468 (94%) | 1226 (78.5%) | 279 (17.9%) | 274 (17.6%) |
| 50 >= count > 25 | 2 (0.1%) | 3 (0.2%) | 25 (1.6%) | 19 (1.2%) |
| 75 >= count > 50 | 10 (0.6%) | 4 (0.3%) | 24 (1.5%) | 23 (1.5%) |
| 100 >= count > 75 | 8 (0.5%) | 9 (0.6%) | 30 (1.9%) | 29 (1.9%) |
| count > 100 | 73 (4.7%) | 319 (20.4%) | 1203 (77.1%) | 1216 (77.9%) |
About
On the Origin Of Spam is published as weekly and monthly reports by B. Johannessen in the hope that it will be useful to the anti-spam community.