New Trends in Spam

SpamButcher's code is exceedingly good at spam blocking. However, even when it's catching 97% of it, over a few days the missed spam can really pile up. When we get these missed messages in our own inboxes, or sent in by users, they get evaluated. Periodically, the collected data is integrated into a new revision of the filter.

Historically, messages were evaluated mostly on an individual basis. In a change in strategy, we decided to try categorizing messages based on their similarities prior to further analysis. What we found is quite interesting. At any point in time, about 80% of spam missed by the email filter fell into about 10 well defined campaigns.

These campaigns are easily recognized when viewed by the human eye. The messages commonly are formatted similarly, with similar content. The problem is that more advanced spammers use software to dynamically alter nearly every word and character in each message by using synonyms and intentional misspellings.

Often, the spammer still uses a common phrase or piece of HTML formatting across all of their messages. This may be accidental, or may be needed to easily reference their own back-end software. One way or the other, it makes them more susceptible to spam control software. To date, most updates to the filter have targeted spam in general as opposed to specific campaigns. The newly collected data suggests a minor change in tactics may be in order.

Back