MainSleaze

ESP mail seen in spamtraps August 2016

The theme of this month’s post is a specific company, unfortunately. The questionable honour goes to SMTP.com, Inc.

The percentage of ESP sent mail vs all mail seen in the spamtraps is 2.3%. The amount of ESP mail was almost 50% higher than last month, with the total amount of mail a little less (-15%) than last month. The remarkable raise appears to be due to a very small bunch of bad customers contaminating only two ESPs.

The Spanish folks from last month dropped back to oblivion, but we have two new entries in the top 10, at #1 and #10 respectively, and more new entries in the top 30 (that are alluded to in the “relative badness” graph). The reason for this month’s #1 appears to be a single customer only, and there are indications that the same customer has been contaminating other ESPs too (the #2 in “relative badness” didn’t quite make it to Top 10 despite a valiant effort, but has been having problems with anonymous Finnish spammers for quite some time). From what I already heard, this sounds like a bit of a vetting failure to begin with, followed by a failure to notice a problem and contain it (as it went on for more than a week).

Bubbling under: Blue Hornet, Moosend/Mailendo (both at 2%), Rackspace Mailgun, Mail Minion (both at 1.9%).

Here’s the “relative badness” graph. Some observations are in order.

SMTP.com, Inc. wouldn’t usually make even the top 30, and their “relative badness” would normally be in line with MailChimp (i.e. “the least bad of them all”), but they’ve had a surprise from some Nordic spammers in mid to late August that appears to have been long in the brewing.

Moosend/Mailendo, a Greek/UK ESP, appears to have been targeted by the same bunch. At least the domain names and message contents are remarkably alike. The sending of erotika-club.com started on August 9 and was contained on August 12, but not before they had managed to be responsible for over 90% of the output of this ESP (which normally flies completely below the radar, despite housing all the usual anonymous affiliate suspects) this month.

Average amount of messages per separate customer of ESP, August 2016

Finally, the “top spamming customers” table, which is rather unusual this month.