Atomicorp

90% of the spam that's hitting our servers is from botnets
99% of that spam seems to be to addressed to (random string)@domain.tld and sent in groups of mostly first-letter alphabetic order and mostly in groups of no more than 9 messages, each group from a different IP:

Here are some examples of the random string addresses I'm talking about:
The examples above include a numeric element, but this isn't always the case. More often than not there are no numerics. However, when there is a numeric element, it is ALWAYS at the end of the string, like in the examples above. In addition, no address string ever seems to be longer than 12 characters long.

Initially I thought that these strings may in fact be encoded addresses (e.g. base64 or something) that the spammers had accidentally not decoded. I've tried every decoding option I could find on the internet and have not been able to generate any meaningful addresses. If anyone would like to try their hand at decoding them, it might be fun? I could easily have missed an obvious decoding method.

However, given that the numeric element is always at the end of the string, and that no string I've seen is longer than 12 characters, I've started to think that maybe something else is going on. Specifically, I'm wondering if what we're seeing is a poisoned list.

I had a quick look at some of the spam poisoning code that's out there, but couldn't find anything that specifically said it generated X character random-alpha string with a maximum of Y numeric etc. But It certainly seems like this may well be a case of a very successful spamlist poisoning.

What do people think? Possible?

Do any of you know of any forum or mailing list where this sort of thing gets discussed? I'm very interested in the spam trends and delivery methodology.

Definitely the kind of thing Id use for poisoning and/or honeypots. We have lots of hidden email addresses embedded all over various pages here to route spam & malware to our honeypots.

Another thing it could be is cover traffic for valid email addresses. Spammers prey on other spammers for data as well. Perhaps this is to make that data more worthless.

I don't quite get what you are saying, I'm afraid. Sorry for being a bit dense today.

Another bit of data to add: this has been going on for months. You'd think someone somewhere would have noticed that they are getting 0 return on their "investment"?