In mid March 2008 the hit rate to some blacklist providers (spamhaus and others) dropped by 50%. There was a story on German heise news portal on March 31st about that topic. In the statistics of our mailserver we also can see the drop in rejected mail from two different blacklists:
Fig 1: Hit rates of our mailserver for two different blacklists. Please note that the scale is logarithmic.My blacklist hits from Spamhaus did rise in from 100/h in Nov/Dec 2007 to 300/h in Jan/Feb 2008. But suddenly in mid March it dropped back to the level of November. Did the spammer really give up? Was that the first victory? Or is this just the preparation for a better attack?
If you analyze the statistics of our mailserver further and take a closer look the the mails that passed the blacklisting you find the rate of mails being stopped by Spamassassin did rise the same amount blacklisting did loose. The next figure shows the percents of mail being stopped by blacklisting, greylisting, spamassassin and finally all mails accepted.
The percentage of the accepted mails basically remains constant from mid December between 5% and 10% mainly depending on the day of the week. The fraction of the mails rejected by blacklisting dropped from 70% for both blacklists in January to 50% now. In the same time the fraction rejected from spamassassin rose from 10% to 20% while greylisting rates remain constant.
Given all that data I would conclude that the spammers did not gave up, but enhanced their capabilities and reacting faster to blacklisting. They recognize where it is in effect and stop wasting resources there. They even more concentrate on these domains / servers / secondary servers, where blacklisting is not included. From these observations two conclusions can be drawn:
1) Spammers are clever and constantly working on their tools.
2) Blacklisting seems to work against spammers. It seems that this is really a good option in the fight to regain control over the inboxes.
