China finally cleans up spam act

happygeek 1 602 Views

According to new figures, published today by Sophos, something strange has happened in the world of spam: China has dropped out of the list of the world's worst spam relaying countries for the first time ever.

The Sophos 'Dirty Dozen Spammers' list has become something of a staple diet for security researchers, covering the top twelve countries in terms of how much spam they each relay every quarter.

While there is no surprise in seeing the US remain firmly seated at the top of the guilty as hell pile, responsible for relaying an astonishing 13 percent of all global spam (or hundreds of millions of junk messages every single day, although you may not actually see any of it) the fact that China has dropped out of the Dirty Dozen has come as a huge shock for many list observers.

China has completely disappeared from the list, dropping down to 15th place on the global scale and being responsible for 'only' 1.9 percent of the world's spam according to Sophos.

That said, if you look at spam by continent rather than country, Asia continues to dominate with more than a third of the world's unsolicited junk email relayed by the region. Although the US remains the top offender by country, North America as a whole has reduced its spam throughput since last quarter, dropping from second to third place behind Europe.

"All eyes aren't so much on which countries are on the list, but the one which isn't. China has earned itself a bad reputation in many country's eyes for being the launch pad of targeted attacks against foreign companies and government networks, but at least in the last 12 months they can demonstrate that the proportion of spam relayed by their computers has steadily reduced" said Graham Cluley, senior technology consultant at Sophos. "A new dirty 'gang of four' - South Korea, Brazil, India and their ringleader USA - account for over 30% of all the spam relayed by hacked computers around the globe".

The top twelve spam relaying countries for January to March 2010 are as follows:

1. United States (13.1%)
2. India (7.3%)
3. Brazil (6.8%)
4. S Korea (4.8%)
5. Vietnam (3.4%)
6. Germany (3.2%)
=9. United Kingdom (3.1%)
=9. Russia (3.1%)
=9. Italy (3.1%)
10. France (3.0%)
11. Romania (2.5%)
12. Poland (2.4%)

Others = 47.3%

Dani AI

Generated

As noted, the Sophos "Dirty Dozen" item made a striking headline when China dropped out of the country rankings. That result is useful, but it is a snapshot that needs context: such lists measure where spam is being relayed or where sending hosts are observed on the network, not necessarily the nationality or location of the people orchestrating the campaigns. Rankings can move quickly because of takedowns, sinkholing, measurement-method changes, or shifts in which compromised hosts spammers prefer to use.

Both and touch on common explanations. A frequent pattern is that attackers adapt — moving to compromised machines or hosted relays in the markets they target, using botnets, rented VPS, or misconfigured mail servers inside those countries. That makes the headline number reflect infrastructure location and filtering effectiveness as much as "who is spamming." It is prudent to treat country-based spam stats as an indicator, not a definitive attribution.

Practical mitigations and monitoring workflows that close gaps left unaddressed in the thread include regular outbound-mail auditing, strict outbound port-25 controls for endpoints, and deployment of email authentication and reputation controls. Recommended items: keep servers and web apps patched, scan for compromised scripts that send mail, throttle outbound mail from new/unknown senders, and rely on reputation services or hosted mail relays for bulk sending. Example DNS records commonly used as part of a layered defense:

# simple SPF (example)
v=spf1 mx -all

# DMARC reporting (example)
v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com; ruf=mailto:forensics@example.com; fo=1

Country-rank changes are a useful conversation starter but not the whole story. The most resilient approach pairs careful measurement (outbound SMTP logs, anomaly detection, reputation feeds) with basic hygiene (patching, least-privilege mail routing, DKIM/SPF/DMARC) and rapid coordination with upstream ISPs or CERTs when large-scale compromise is suspected.

Member Avatar for dburk
dburk 0 Newbie Poster

This doesn't really surprise me, but I believe this is merely a trend of Chinese based spammers becoming a bit more sophisticated and using Botnets based in the USA to continue to send massive amounts of spam. Eastern European spammers were the first to shift much of there relays to compromised servers within the USA and the Chinese spammers are just now catching up. The US is the primary target market for spam and they have more success by using relays within the US since many spam filters screen foreign based email more thoroughly.

Member Avatar for jennypitts
jennypitts 3 Junior Poster

I think this has a lot to do with the fact that US is the most important market with regards to online marketing. Therefore, more and more website owners are getting sites hosted in the US, hence spambots are also originated from the US. This is probably the reason why the US is #1 and will probably remain there. India is #2 because as we all know it is the number one place where most of the internet outsourcing gets done from.

Edited by jennypitts because: n/a
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview