Spam Trap Flow Statistics

These graphs are total email flow into one of our larger (but not nearly largest) spamtraps. This is intended to give a reasonably representative indication of overall spam flow.

The Y axis is emails per second. "5.0k" means 5000 emails/second. For each 1000 emails/second this trap averages over a day, the total is another 86 million emails/day. For example, a 5000 emails/second average over a day represents 432 million emails per day.

The X axis is the date/time in GMT.

No attempt is made to distinguish spam from non-spam email hitting the trap. For example, the total flow numbers will undoubtably include "backscatter". Backscatter is where spam is created with a forge sender address, and is sent to a mail server that rejects the email by a bounce - to the forged address. The CBL does not list IP addresses for this reason, but other DNSBLs do.

Generally speaking, more than 95% of the hits represented in this graph result in a CBL listing.

One of the more important things to take away from these graphs is the highly cyclic volume of spam being sent.

Note also the abrupt dip at Dec/Jan of 2010/2011, and March 2011. The first was when the Rustock bot operator seemed to go on holiday for almost two weeks. The second was when the Rustock bot was finally killed.