Where Has All My Spam Gone?

An anonymous reader writes "I have my own domain, which has its own email server, where I receive all my personal email. I've been getting about 800 emails a day, of which perhaps 20 are real. Suddenly, Sunday or Monday evening, the spam pretty much stopped. My volume of mail has plummeted to less than 100 a day, and as far as I can tell, I'm not missing any real mail — I'm still getting the email list subscriptions I'm expecting, and every time I ask someone to send me a test message, it gets through. My domain host insists that it doesn't do any spam filtering before mail gets to my inbox, and that they've changed nothing about their configuration. I run SpamAssassin on my server to mark, but not delete, spam, and download the whole mess to my home client, and I'm still seeing the occasional message tagged by SpamAssassin. But it's virtually all gone. And I haven't changed anything about my own mail configuration, or the harvestability of my site (my personal email has been harvestable for almost a decade). So what's going on? I can't believe that several major botnets would have vanished overnight. Any ideas?"

Hmm

*Checks mail logs*

Yeh, you need to ask the ISP again. No sign of slowing here.

Re:Hmm

Agreed. No changes in spam over here, my domain is still receiving the daily average of about 100 per day.

Re:Hmm

Thirded over here. Solid 7000/day for months (small business).

Re:Hmm

A group of the original SpamAssassin developers got together with a group of mercenaries and created SpammerAssassin. It's in alpha, and looks good except it seems to have started a teeny-tiny war in the eastern bloc. Oops. They have an open bug ticket on it.

:D

I'm getting it

My spam has tripled over the past few days. So I'm not getting all of it, but I'm getting a chunk of it.

Did you install Skynet 1.0?

Did you install Skynet 1.0?

Hey, what's that siren going off for....

Because...

When spammers took over your box, they didn't want to flood it with their own mail.

One down

Per Ars, a 100,000 machine bot net was shut down recently. http://arstechnica.com/news.ars/post/20080814-police-nab-shadow-creators-force-botnet-to-commit-suicide.html [arstechnica.com]

Oops...

Sorry, we've been down for maintenance and it's taking a lot longer than we originally planned. You can expect normal service to resume by next monday.

So it's become real...

Spam Assassin is actually assassinating spam.

On another note, has anyone heard from cousin who is a Nigerian prince? He hasn't called in days and we're beginning to get worried.....

those chinese spam factories are shut down ...

... to save the health of the athletes.

The Russians are busy in Georgia...

...and the Chinese are busy watching 13-year olds win gold metals. Bob

We Can Test

We're happy to help you solve this mystery.
What is your email address?

We got bored of the joke

Okay, here's the thing: nobody but you ever got spam. We all just thought it would be funny to fool you into thinking there was some kind of worldwide scamming epidemic. You don't seriously think people would be stupid enough to buy pills off strangers who email them out of the blue, do you? I thought we'd gone a bit too far and stretched the limits of credibility when we came up with the idea for the Nigerian scams, but I was wrong, you even fell for that! Nobody is stupid enough to send all their money to a "Nigerian prince".

Anyway, enough's enough. The joke's stale now, so we decided to stop sending it all to you.

Spam has relatively few sources

A large chunk of spam comes from a very small group of spammers. It may just be that you are only targeted by one of them, and he took a break recently.

Hang in there... he'll come back from vacation soon, and you'll be able to mortgage your penis to Nigeria again.

I can kinda confirm this.

I run a web hosting company and over the past couple weeks I've had a few customers report that the amount of spam has dropped. Of course, they thought that this was something wrong, but I couldn't find any evidence of increased failures, it was just that there was slightly less mail coming in.

Botnets current tasked to higher priority jobs

http://it.slashdot.org/article.pl?sid=08/08/12/191255&from=rss [slashdot.org]
http://bits.blogs.nytimes.com/2008/08/11/georgia-takes-a-beating-in-the-cyberwar-with-russia/ [nytimes.com]

When the crisis abates, I expect the botnets will be returned to their regularly scheduled duties. Quite a versatile tool those botnets -- pimping V!agr4, collapsing government sites, enhancing the male doodad, distributing pr0n, bullying your neighbors (http://news.bbc.co.uk/2/hi/europe/6665145.stm [bbc.co.uk]). For the cost of one M1A1 tank tread, Putin bought himself a whole lot of firepower.

Advantage: Putin.

headless botnets

We've been seeing botnets changing desktop background to an image alerting people that they are infected with a virus. Obviously a real spam botnet operator would not alert people like that.

My theory is that some grayhat wrested control of a major botnet, and is shutting it down from the source (and alerting the victims in the process).

We Apologize

Dear Sir,
We humbly apologize for the interruption in service. Please reply with your email address and our technical staff will get back to you.

Re:Okay

Perhaps he'd like to leave it to systems he controls? I, for one, would rather a third party weren't silently dropping mail that could be false positives.

Re:Okay

He isn't complaining. It isn't wrong to ask questions when things unexpectedly go well.

Re:Exactly.

Assuming a third party isn't dropping your email... if they are then that's almost as bad the spam deluge - I'd rather be the one to decide what is spam than a third party who may or may not have a clue.

Re:Exactly.

I, on the other hand, consider sudden, dramatic, and completely unexplained changes to the operation of systems under my control to be a reason to worry.

I'm just funny that way.

Re:I can forward you some of mine if that helps...

That might actually be a not bad idea. Sending him something that can be confirmed as having been sent, and as being spammy.

Re:we are all doooomed

Naw, just that the Russians have shifted all their botnets' attacks toward Georgia.