[nsp-sec] anomalies?

[Joel Rosenblatt]

Looks like the numbers are down

2009

27 1,079,111 spam and other junk came from 186,666 unique IP addresses
28 1,219,738 spam and other junk came from 210,886 unique IP addresses
29 1,285,179 spam and other junk came from 226,609 unique IP addresses
30 1,285,490 spam and other junk came from 229,887 unique IP addresses

2010

26 877,205 spam and other junk came from 130,124 unique IP addresses
27 830,191 spam and other junk came from 107,872 unique IP addresses
28 827,000 spam and other junk came from 120,524 unique IP addresses

Joel


--On Tuesday, December 28, 2010 7:38 PM +0000 David Freedman <david.freedman at uk.clara.net> wrote:

> ----------- nsp-security Confidential --------
>
> Does anybody have graphs showing what the levels were like last year at this
> time? Although this looks quite low, have nothing to compare against.
>
> Dave.
>
>
>
> On 28/12/2010 19:19, "Gilmore, Patrick" <patrick at akamai.com> wrote:
>
>> ----------- nsp-security Confidential --------
>>
>> On Dec 28, 2010, at 12:55 PM, Joel Rosenblatt wrote:
>>
>>> Didn't you get the memo?  It's an official Bad Guy Holiday :-)
>>>
>>> Our spam numbers were down below 1 million .. it's a very slow day
>>
>> In all seriousness, I'm seeing reports of very low spam, viruses, trojan'ed
>> attachments, etc. from several places.  For instance, a couple publicly
>> available graphs:
>>     <http://cbl.abuseat.org/totalflow.html>
>>     <http://www.spamcop.net/spamgraph.shtml?spammonth>
>>
>> I have also seen multiple reports from multiple places that the Rustock botnet
>> is either very slow or even completely down.
>>
>> This makes some people happy.  It worries others.  Are they just taking a
>> holiday?  Or are they gearing up for something worse?
>>
>> Anyone have any intel?
>
> --
>
> David Freedman
> Group Network Engineering
>
> david.freedman at uk.clara.net
> Tel +44 (0) 20 7685 8000
>
> Claranet Group
> 21 Southampton Row
> London - WC1B 5HA - UK
> http://www.claranet.com
>
> Company Registration: 3152737 - Place of registration: England
>
> All the information contained within this electronic message from Claranet
> Ltd is covered by the disclaimer at http://www.claranet.co.uk/disclaimer
>
>
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________
>



Joel Rosenblatt, Manager Network & Computer Security
Columbia Information Security Office (CISO)
Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
http://www.columbia.edu/~joel
Public PGP key
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x90BD740BCC7326C3