One of the most interesting set of statistics we can pull out of the Trap25 databases is the prefixes of emails getting the most spam. By prefixes, we mean the part of the email before the @ i.e. yourname@yourdomain.com. yourname is the prefix.

Common webmaster lore suggests that certain types of prefixes get the most spam because they are prevalent on many websites. Especially those that are selling a product. i.e. sales@yourdomain.com, support@yourdomain.com, webmaster@yourdomain.com, abuse@yourdomain.com. We aactually have an FAQ recommending that customers do not use certain email addresses should they wish to avoid spam.

We compiled a report from the Trap25 database for the last 3 months (top5).

info@ – 109,448 emails blocked
sales@ – 61,304 emails blocked
mail@ – 45,832 emails blocked
enquiries@ – 28.048 emails blocked
admin@ – 23,408 emails blocked

In terms of spam ratio i.e. total spams to the amount of sites/domains with the corresponding prefix:

mail@ – 462.7 spams per domain per month (average)
enquiries@ – 389.6 spams per domain per month (average)
admin@ – 300.1 spams per domain per month (average)
sales@ – 292 spams per domain per month (average)
info@ – 218.4 spams per domain per month (average)

Thus, if you don’t have a decent Spam Filter, avoid the above prefixes if at all possible.

With regards to our previous post last month Where Does All The Spam Come From we briefly mentioned that our own custom built, reactive real time blackholing service was in place.

This means that should a particular IP send us more than 5 emails, which the spam filter tags as spam, it will be blackholed for up to 1 week. We discovered that a significant amount of spam is sent from compromised hosts / servers. Rather than have our systems process spam from these hosts repeatedly, reactively blocking them after a certain amount of spam had come into the network was a logical choice. Reduce the risk of any of that spam actually getting through to our customer base, and reducing the CPU load on the spam processing servers.

We’ve noticed that over the few months we have been monitoring this, the amount of email being filtered by the spam servers has reduced whilst maintaining the proportion of total email received. July | August | September.

We’re always looking to reduce spam here at 3DPixel.net. In doing so we come across interesting statistics that we like to share with you, if you are so inclined of course.

Where Does All Our Spam Come From? shows a list of countries, and the corresponding count of IPs (Eurovision style listing) that we have now proactively blocked once they pass the ‘5 spams per IP’ threshold that we set internally. The spam that we receive from these IPs must be sufficiently high that we can say with all confidence ‘this is spam’. We add the 5-time threshold simply for completeness.

We update this list every 20 mins from the live Trap25 / Spamgate systems.

Proactively blocking repeat spammers reduces overall network load on the Spamgate servers, meaning we can get email to you quicker.