May 2021 in Spamtraps: ESPs
Here’s a monthly summary of our findings in May 2021. Because of a major glitch at an otherwise unremarkable operator the total of ESP mail is noticeably larger than the month before (from 6.6% to 6.8%), the top 10 has a new participant that would never appear on the list otherwise, and the share of the top 10 out of everything is much larger than usual.
| Rating | Participant | Percentage | Notes | Most prominent customer |
|---|---|---|---|---|
| 0 | All others | 33.2% | ||
| 1 | Salesforce Marketing Cloud | 14.1% | Marcus & Millichap (4%) | |
| 2 | SendGrid | 13.9% | Uber (7.2%) | |
| 3 | Retarus | 12.0% | Mostly backscatter | MAILER-DAEMON (99%) |
| 4 | Mailchimp | 8.0% | Egyeditermekek.net (0.9%) | |
| 5 | Amazon SES | 5.7% | Netflix (9.3%) | |
| 6 | Oracle Marketing Cloud | 3.2% | Harborfreight.com (3.5%) | |
| 7 | Epsilon | 3.0% | DICK’S Sporting Goods, Inc. (57.5%) | |
| 8 | Mailgun | 2.9% | With some spillover from Mailjet | Harri.com (3.3%) |
| 9 | CheetahMail | 2.1% | Talbots.com (11.4%) | |
| 10 | Constant Contact | 2.0% | Rentv.com (1.5%) |
with their shares of the total and most prominent customers
This month’s special feature is a flood of backscatter from Retarus, a German ESP whose presence in our traps is usually so insignificant that they’re not even in the top 40. Early this month, there were two outbursts of this activity, between 7 to 11 am UTC on May 3 and between 3 to 7 am UTC on May 6. It is only the second time that backscatter causes an ESP to make an appearance here, the first, if memory serves, having been Hobsons in July 2018.
After taking a closer look last period, I noticed that our handling of the merged operations of Mailgun and Mailjet is somewhat wonky, which explains the appearance of any given customer on both at the same time. To be honest, it doesn’t help that they appear to be borrowing IP blocks from each other. But this is a problem that I expect will resolve itself in the short to medium term as the merger is eventually completed (one hopes, anyway).
