Fun with data: DKIM selectors from spam


This may not be super scientific, but it is something I'm going to have fun with nonetheless. Let's take the last thirteen days worth of spam sent to spamtrap addresses in my Wombatmail spamtrap feed, which means somewhere around 63,000+ spam messages. What percentage of the mail is signed with DKIM authentication? About 44%. Of that 44% of DKIM-authenticated mail, what are the most popular selectors? Here you go, please and enjoy.

Top DKIM selectors seen in my spamtrap feed, from a 13 day snapshot taken in March, 2023:
  1. s1024-2013-q3 (9.73%)
  2. mail (5.84%)
  3. 200608 (5.17%)
  4. k1 (3.75%)
  5. 10dkim1 (3.34%)
  6. DEFAULT (2.95%)
  7. default (2.95%)
  8. key2 (2.81%)
  9. ug7nbtf4gccmlpwj322ax3p6ow6yfsug (2.66%)
  10. root (2.60%)
  11. k2 (2.30%)
  12. 20230601 (2.01%)
  13. 11dkim1 (1.67%)
  14. ep1 (1.53%)
  15. hs1 (1.36%)
  16. smtp (1.23%)
  17. acdkim1 (1.12%)
  18. 1000073432 (0.93%)
  19. app (0.93%)
  20. fnc (0.92%)
  21. 20221208 (0.89%)
  22. mailo (0.85%)
  23. 12dkim1 (0.77%)
  24. key1 (0.74%)
  25. sailthru (0.70%)
  26. ekhpnuc3dplckhimqqmmyo4ffsgzlwyw (0.67%)
  27. 224i4yxa5dv7c2xz3womw6peuasteono (0.62%)
  28. DKIM (0.61%)
  29. dkim (0.61%)
  30. hs2 (0.59%)
  31. 7v7vs6w47njt4pimodk5mmttbegzsi6n (0.53%)
  32. mta (0.53%)
  33. uku4taia5b5tsbglxyj6zym32efj7xqv (0.52%)
  34. 13q2 (0.51%)
  35. scph0920 (0.51%)
  36. spop1024 (0.49%)
  37. selector1 (0.48%)
  38. dk (0.48%)
  39. m1 (0.46%)
  40. ctct1 (0.44%)
  41. nc2048 (0.42%)
  42. mte1 (0.41%)
  43. 12042023 (0.40%)
  44. j224evkrvp5yihqpdjcnkdjekt5advkt (0.35%)
  45. 50dkim1 (0.34%)
  46. ltk1 (0.33%)
  47. pins (0.33%)
  48. 0 (0.32%)
  49. scph (0.32%)
  50. gears (0.31%)
  51. newsletter (0.31%)
  52. emm (0.28%)
  53. ttcczf5zhduzd2exaoyl5puvrsfehfsn (0.28%)
  54. mx (0.27%)
  55. cpm (0.24%)
  56. pic (0.23%)
  57. sendsay202111 (0.23%)
  58. rlntogby6xsxlfnvyxwnvvhttakdsqto (0.23%)
  59. s1024 (0.23%)
  60. scph1122 (0.23%)
  61. key4 (0.22%)
  62. cs2013 (0.22%)
  63. key5 (0.22%)
  64. smtp4 (0.21%)
  65. neolane (0.21%)
  66. cm (0.21%)
  67. shh3fegwg5fppqsuzphvschd53n6ihuv (0.21%)
  68. 7777 (0.20%)
  69. dkim1024 (0.20%)
  70. krs (0.20%)
  71. mailjet (0.19%)
  72. scph0522 (0.19%)
  73. 13dkim1 (0.19%)
  74. 51dkim1 (0.19%)
  75. scph1021 (0.18%)
  76. 20211110 (0.18%)
  77. scph0823 (0.18%)
  78. class (0.18%)
  79. hsbnp7p3ensaochzwyq5wwmceodymuwv (0.17%)
  80. s1024a (0.17%)
  81. medallia1 (0.17%)
  82. scph0720 (0.16%)
  83. S1 (0.16%)
  84. s1 (0.16%)
  85. scph0321 (0.16%)
  86. private (0.16%)
  87. pepipost (0.15%)
  88. id0517 (0.15%)
  89. qftdzk2dqsatjnlrq4r5brjbihpfcrsh (0.14%)
  90. scph0517 (0.14%)
  91. macys (0.14%)
  92. scph0819 (0.14%)
  93. dkim1 (0.14%)
  94. sp2210 (0.13%)
  95. 20190611194940pm (0.13%)
  96. 6t5uyq7pwdjd55w7xbgn3fcjwiphlni6 (0.13%)
  97. nc (0.13%)
  98. mykey (0.13%)
  99. en-japanmail20221031 (0.13%)
  100. s0315 (0.13%)
And that.... is a rather random data set.
Post a Comment

Comments