We've noticed a significant increase in udp/1030 activity in the past 24 hours.  Our initial assessment is that this is a new form of pop-up spam.  If you have captured any of this and have thoughts or analysis you can contribute, please drop us a note on our contact page.  (Update:  earlier I had said "tcp" vice "udp" - I didn't pay close attention to our sensor outputs.  It should be udp.)  (Second update:  this is pop-up spam.  Thanks to those who sent in samples.)