I’m taking a timeout from recollecting my memoirs of my trip to Spamatopia to examine the current state of the Spam World. Traffic statistics indicate that the level of spammer volume has subsided substantially in the month of March (and even in February to a lesser extent). The historical average between the start of one spam run to the next is 8 days with the average in-between waiting period of 3.5 days (which means spam runs last around 4.5 days per instance).
Looking back over our logs, we had a large spam run from Feb 23 – Feb 28, a period of six days which is longer than the historical average. There was a quiet period of 4 days and then on March 5 another run started. However, this one lasted only three days. Furthermore, average volume was tracking only 15% greater than the March 1 – March 4 period, whereas Feb 23 – Feb 28 tracked 23% greater than the preceding quiet period.
After March 5, the next spam run lasted only one day on March 13, and traffic ran only 17% above the quiet period. We had another quiet period, a high-volume run on March 16, a very quiet period and then a two-day run on March 19-20. Yesterday was also very quiet. To summarize that gibberish, in March so far for the first 21 days, we have had 14 quiet days and 7 spamming days, and 4 of those spamming days have been below the historical average increase in traffic.
This means that so far in March, 2/3 of the days of the month have been quiet. If we go by our 4.5/8 days spamming, we would have expected only 9 days of quiet (as opposed to the current 14).
Looks like one or a combination of the following: spammers are regrouping, they are sending out less spam (because they are getting caught and therefore there are fewer spammers), spam filters are getting better, they are collaborating with virus writers coming up with better ways to get around spam filters and the process takes time, or they are sending out fewer spam because the attacks are more concentrated and direct (ie, spam a particular domain really hard). The battle continues…