Inside Scoop on a Spam Filter Update

We just finished analyzing the last batch of several hundred spam messages that SpamButcher failed to catch. To our delight, a large portion of them fell into about 10 different well-defined campaigns. This makes them good candidates for including in the spam blocking software.

While the number of spamming computers reaches into the millions, the number of actual different spam campaigns is much smaller. Also, there is almost always one of a number of different software packages actually sending the junk email. As spam campaigns become more advanced, the software often integrates support for affiliate schemes right into the email messages. This information can sometimes be used to recognize that a message was sent by a certain software package and is therefore almost certainly spam.

One campaign stood out above the others; making up about 25% of all missed spam. If code could be constructed to detect those messages reliably, it would result in a measurable increase in filter efficiency. The spam itself generally pitched "adult" related websites, but what really made it identifiable was the presence of a URL in a certain format.

http://asd.adomainnamegoeshere.com/?dfsdf=flkeiav_sade.ber

This looks promising, but the letters in the later part of the URL always seemed to shift around – making them difficult for email filters to detect. Also, the domain name always changed and sometimes legitimate emails will include URL's with query strings in them. An email including a URL with a query string is certainly more likely to be spam, but it's not enough information to filter the message by itself.

It turns out that those jumbled letters are actually the recipient's email address. The address is encoded using a very simple letter-substitution scheme. The SpamButcher's antispam filter now knows about it, and can detect it reliably.

Back