Some hard data on current abuse reports

A question that came up earlier was how to address a report that is going
to multiple providers.

I was going to throw out some speculation about how much of an issue
that is, the number of recipients in a typical report and so on. Instead
I decided to gather some hard data.

I did some quick research (on the abuse mailbox of a large consumer
broadband ISP) and found that the vast majority of emails received had
been sent to a single address.

Of a random sample of 15,000 recent emails to abuse@

5,000 were some anti-spammer mailbombing abuse@

4,200 were scomp reports from AOL

2,000 were spamcop reports

1,200 were DMCA takedown notices (all automated, by a variety of
           different systems, mostly easily parseable, though).



That leaves about 2,500 emails that are a mixture of manually generated
reports and spam sent directly to abuse@. Of those:

2338 had 1 recipient
 208 had 2 recipients
  99 had 4 recipients
  87 had 6 recipients
  72 had 5 recipients
  55 had 0 recipients
  52 had 3 recipients
  18 had 8 recipients
   9 had 7 recipients
   6 had 13 recipients
   5 had 12 recipients
   5 had 10 recipients
   4 had 9 recipients
   3 had 17 recipients
   3 had 16 recipients
   3 had 15 recipients
   2 had 18 recipients
   2 had 20 recipients
   1 had 11 recipients
   1 had 943 recipients
   1 had 55 recipients
   1 had 14 recipients
   1 had 19 recipients

Many of the reports with >5 recipients appear to be spam sent directly
to abuse@.

Of those 2,500 emails MIME type broke down as follows:

1207 text/plain
563 multipart/alternative
252 text/html
229 multipart/mixed
48 multipart/related


The vast majority of messages were < 10k in size, with the exceptions
mostly being copies of logfiles (up to 10 megs in some cases).

Cheers,
  Steve