So, about a week ago we first wrote about the data our smtpd honeypot had received. The count for first 3 hours was pretty meager, only around 12 thousand recipients.Now, a week after the initial spamflood began we go back to the honeypot for more statistics. During the week we noticed that in addition of the original spammer sending spam to us the honeypot got selected by a 2000 host strong spam botnet as a relay also.
So, what are the numbers?
We took in 309202 spam messages that were meant for 3814594 receivers. So basically we managed to stop 3.8M spams during the research. Out of 3.8M recipients 3.5M had e-mail address under the .tw ccTLD.
Below a few samples of the stuff that was spamvertized:
It seems that the Video CD’s (VCD) are a pretty popular spam topic. We did not observe any pillpushing spams selling viagra or spams selling replica watches during the whole week.