Subject: Re: [Asrg] Re: 2a. Analysis - Changed patterns in spamming?

From: Andreas Saurwein <[email-masked]>
Date: Thu, 06 Nov 2003 17:10:54 -0200

At 6/11/2003 17:01 Thursday, you wrote:
>While looking at some statistics in my incoming spam, I noticed that the 
>ca 50% of korean spams I had for the last 1.5 year have dropped to nearly 
>zero around Oct. 1. All .kr domains is gone and the asian spam I see is 
>from non asian domains.

While I cant say that my personal account ever received lots of it (3-5 by 
month), it definitely is down almost 0 but it comes from asian domains.

Andreas 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Kurt Magnusson" <[email-masked]>
Date: Thu, 06 Nov 2003 16:01:44 -0300

I took this up around Oct. 15, but never got any response at that time.

While looking at some statistics in my incoming spam, I noticed that the ca 
50% of korean spams I had for the last 1.5 year have dropped to nearly zero 
around Oct. 1. All .kr domains is gone and the asian spam I see is from non 
asian domains.

Question is if the new spam laws in Korea have had an effect or if I just 
see the result of filtering on some trunk line between Europe and Korea?

For if this is a global effect, koreans stopped spamming (ok, ok, but it is 
soon Fathers Day, and this would be better than the tie I never use ;-), the 
antispam community have to consider the impact of legal actions, with the 
new EU law getting in place, definitively marking NA/SA spammers as the main 
culprits.

If not and it is just a local effect, which ISP installed this effective 
filter and how many countries are affected? Might mean that trunk line 
filtering should be considered.

Kurt Magnusson

_________________________________________________________________
MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. 
http://join.msn.com/?page=features/virus

---

From: "Mark E. Mallett" <[email-masked]>
Date: Thu, 6 Nov 2003 14:19:14 -0500

> see the result of filtering on some trunk line between Europe and Korea?

Could be just a change in spammer operations.  Personally I am seeing
less spam via open SMTP relays and more spam via slave machines.  These
days when we get spam barrages, it's a few messages from one IP address,
a few from another, over hundreds of sources.  Some months ago the
pattern was different, where a particular batch of spam would come from
just a few different sources.

mm