Sad Spam

SpamButcher system to block spam email is pretty good at catching most junk e-mail. There's still a handful of messages it misses, and they are increasingly all looking the same.

From: jackyo522@yahoo.com
Subject: about our plans.

I had a super time at that place I was telling you about.  It's at www.elcaminoblue.com.
I'll see you on the dark side of the moon.  Moss grows only on the east side of a tree. 

These kinds of messages are commonly sent using compromised zombie systems. Zombie systems are found all over the internet, making them hard to blacklist. SpamButcher doesn't use DNS blacklists to stop spam e-mail by default, but in it wouldn't help in this case if it did.

The last few sentences in this kind of mailing are randomized. This helps prevent collective filtering efforts like Cloudmark from tagging the message as spam. It also can confuse Bayesian filtering systems. Some extreme efforts randomize nearly every word in the email.

The only static element in the message is the URL. This data point still offers some hope for further analysis. Some filtering systems look up the registration information for the domain. Domains used by spammers tend to be recycled quickly. An email that contains a URL pointing to a domain that was registered just last week may be more likely to be spam.

SpamButcher's anti-spam product doesn't analyze domain registration info yet, but it may in the future. Doing so would create additional network traffic, and possible firewall issues. If this kind of super-junky spam continues to gain popularity, it may be worth implementing.

Back