Who's Making it Past the Filters?

Over the last several weeks I've been coordinating a large update of SpamButcher's internal system for blocking e-mail. It's not so much a re-write, as it is adding a lot of new data points. The data was collected from spam that made it past SpamButcher. Some of the email was collected by SpamButcher as a company, a lot of it was sent in by users.

What's interesting is how much of the missed spam emails were clearly related to each other. I'd estimate that about 80% of it fell into around a dozen different email campaigns.

Some of the spam sending software leaves telltale signatures - indicating that was almost certainly sent by the same sender, or at least someone using the same software. If certain content always shows up in the spam's headers or body, but should never be in a legitimate message, it can easily be filtered by the spam email software once the appropriate rules are added.

More frustrating was the spam that I could personal recognize as belonging to a certain set of messages, but had difficulty coming up with a set of rules for it to trap. For instance, a certain campaign might always include one URL, followed by an "adlib" style sentence making illicit references, followed up by about 10 kilobytes of random words.

The filter updates have been in effect long enough to measure their effectiveness, and they certainly show a marked improvement at catching some of the tougher spam. It's distinctly possible to compose a spam email message that will get past most spam mail filter applications; the good news is most spammers still don't now how. I can live with the 2-4% who have figured it out.

Back