I'm not complaining but in the last few days the spam load dropped to
about 20%% of the usual. Is there a holiday in China/Russia/Korea or
has a major botnet been disrupted?

Thane

Appearing in apache logs lately:
"GET / "HTTP/1.1" http://readrun.com/item.php?group_ID=<###>&id=<###>" ...

These simply look like simple proxy tests. However, readrun.com resolves to
a few dozen European and Chinese addresses (probably zombies) and the
registration is through paycenter.com.cn with a fake address and phone
number in the US. (Registered last week, too)

Nameservers are your best clue. The name servers are ns0.iwantfreshmeet.com
and ns0.yayathergood.com both resolving to zombie addresses in the U.S. Put
this all together and it spells RBN. The "proxy tester" is probably a
malicious web site.

In case you or one of your customers has a vulnerable web site, you may
want to make sure your DNS server resolves readrun.com to 127.0.0.1 .

Sites found as of 3/10/2008 5:14:14 PM CST
csv format with header

----
Domain, IP, DNS, Registrar
agatecabpast.com,[118.129.65.87],FUSCADNS.COM,XIN NET TECHNOLOGY CORPORATION
etapehobdeep.com,[118.129.65.87],FUSCADNS.COM,XIN NET TECHNOLOGY CORPORATION
joistadsgeneral...

Receiving lots of emails from: webmaster@web-hits.com
March 9 2008

On Mar 8, 4:50 am, Andrzej Filip example.net> wrote:

It is another *presentation format* with added per country and ASN summaries
of data published at http://www.spamcop.net/w3m?action=hoshame
* ASN info: asn.routeviews.org http://www.routeviews.org/
* Country info: zz.countries.nerd.dk http://countries.nerd.dk/

Top 200 targets of spamcop.net spam reports
For *the week* ending Mon Mar 10 07:13:50 2008 UTC
----------------------------------------------------
Total spamcop.net spam reports volume: 117377670
Top200 share of all spamcop.net spam reports: 3.89%% (4565846/117377670)

*Top12 IP Adresses (The Dirtiest Dozen)*
#;IP;Country;ASN;prefix;spamcop.net spam reports;age;duration;reverse DNS
1 202.75.56.7 MY AS17971 202.75.56.0/22 151449 25.0 h 32.6 d
2 202.75.56.214...

"Caveat: Quantity is not necessarily a measure of Quality"

Newsgroup.................: news.admin.net-abuse.email
Stats Were Taken..........: Mon, 10 Mar 2008 07:10:00 GMT
Stats Begin...............: Mon, 03 Mar 2008 08:17:59 GMT
Stats End.................: Mon, 10 Mar 2008 04:19:09 GMT
Days......................: 7
Total No. of Articles.....: 322
Total No. of Characters...: 905586
Total Volume..............: 884
Messages Per Day..........: 46.0
Characters Per Day........: 129369.4
Average Daily Volume......: 126 kB
Total Posters This Week...: 104
Messages with Sigs........: 34.16%%
Original Content Rating...: 64.99%%

Top 10 Prolific Posters: Posts / Posts per Day / Percent Share
==============================================================
1. Mister Fred Ma....................................: 25 3.6 7.8%%...