MainSleaze

Here’s a monthly summary of our findings in May 2021. Because of a major glitch at an otherwise unremarkable operator the total of ESP mail is noticeably larger than the month before (from 6.6% to 6.8%), the top 10 has a new participant that would never appear on the list otherwise, and the share of the top 10 out of everything is much larger than usual.

This month’s special feature is a flood of backscatter from Retarus, a German ESP whose presence in our traps is usually so insignificant that they’re not even in the top 40. Early this month, there were two outbursts of this activity, between 7 to 11 am UTC on May 3 and between 3 to 7 am UTC on May 6. It is only the second time that backscatter causes an ESP to make an appearance here, the first, if memory serves, having been Hobsons in July 2018.

After taking a closer look last period, I noticed that our handling of the merged operations of Mailgun and Mailjet is somewhat wonky, which explains the appearance of any given customer on both at the same time. To be honest, it doesn’t help that they appear to be borrowing IP blocks from each other. But this is a problem that I expect will resolve itself in the short to medium term as the merger is eventually completed (one hopes, anyway).

This follows the earlier July to September post – the trends continue to be more important than the spot figures. The percentage of ESP spam of all mail was 9.7% in October.

July to September 2018 in Spamtraps: ESPs

We had an unexpected participant in Hobsons, who traditionally send effectively nothing to us, only just about enough for us to have recognized that they even exist. It appears their network space is shared between the ESP and some other branch of their operations. The servers of the non-ESP operations were misconfigured on April 10 shortly before 8 pm UTC and started spewing out backscatter (bounces of spam to the forged sender addresses). This went on until 9/11 @ 11 am UTC, peaking in July.

With Yesmail, the money mule spammers (subjects: “New offer”, “New vacancies in our company”, “Interesting work”, “Staff Wanted”, “Good day!”, “Hello!”, “Interesting offer”, “Welcome to our company”) started appearing in April, peaked in July, and were effectively out by September. The numbers of this type of spam on any other ESP platform are never measured in more than the single digits.

Worst senders:

1. SendGrid: Advisor Perspectives, by a margin of more than 2x to the next contestant, month after month (with a slight nod in the general direction of Airbnb in July)
2. SMC/ExactTarget: Kohls (only barely), with Marcus Millichap popping up in September
3. MailChimp: Advisor Perspectives (WTH?)
4. Oracle: Nordstrom (only barely)
5. Mailgun: The Italian affiliate spammers (see previous blogs)
6. Yesmail: After the money mule trash, mktgdillards.com
7. Amazon SES: jobalert123.com
8. CheetahMail: shopbonton.com, loft.com, emailtuesdaymorning.com (all almost below the noise floor)
9. Constant Contact: 123dj.com (only barely)
10. IBM: tjx.com, renewlife.com
11. Mapp: conservativeintel.com
12. Epsilon: DICK’S Sporting Goods, Inc.

ESP spam seen in spamtraps, June 2018

Read more…

Good morning, Munich…

November 2017 to February 2018 in Spamtraps: ESPs

Nuff said. All the data is there and questions are welcome, either in comments to this article or in other avenues. Just haven’t gotten around to writing it up.