Subject: [Asrg] Measurements on spam

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 10 Mar 2003 11:57:14 -0800

All,

	It would be usefull to see some empirical info that measures the
following:

1) Spam transport mechanisms
	Percentage of spam sent through open relays
	Percentage of spam that has a bogus from address
	Percentage of spam that does not comply with RFC 822

2) Spam subject matter
	Section 419 Fraud
	Pornography
	Consumer scams
	Spm to sell spam

3) Evidence of anti-spam techniques
	Mutating subject lines

	It would be good if some of the people with access to large spam
corpuses could take a look at these. Although I don't think that we
necessarily need to know much more than you would get from lumping stuff
into buckets of 0-5%, 5-10%, 10-50%, 50%-90%, 90-95% and 95-100%. Either
something is common or it is not.

In addition there are a bunch of phenomena that I think deserve a bit more
investigation. One of these is bogus spam. There is an advert for septic
tank fluid going round that is clearly not sent to send septic tank fluid. I
think that it is being sent to try to sell spam, legitimizing the concept,
leading idiots to think it must work etc.

		Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Jason Hihn <[email-masked]>
Date: Mon, 10 Mar 2003 16:08:02 -0500

It doesn't matter. The nature is transient. If you make spam improbable in
one category, it'll get flooded because it's improbable. If you try to base
your anti-spam tactics on the statistics of today, tomorrow it'll be
different.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Hallam-Baker, Phillip
Sent: Monday, March 10, 2003 2:57 PM
To: [email-masked]
Subject: [Asrg] Measurements on spam

All,

2) Spam subject matter
	Section 419 Fraud
	Pornography
	Consumer scams
	Spm to sell spam

		Phill

---

From: [email-masked]
Date: Tue, 11 Mar 2003 13:17:07 -0500

> 	Percentage of spam that does not comply with RFC 822 

I'm quite interested in the transport side of things as part of a thought
experiment I'm running about how effective throttling could be.  I'd like
statistics generally on where spam comes from when it gets to a legitimate
SMTP server.

	Open relays
	Spammer servers
	Legitimate outbound SMTP servers through which "work at home" 
		minions are spamming
	Directly from "work at home" machines

Further, when spam arrives, is it bursty? Does it arrive in clumps from
small numbers of sources or is it buried uniformly among legitimate traffic
from all sources?

I know there are some spam archives, and it is worth looking at all the
headers there, but I think the sampling would be quite thin.

Alternatively, if a few largish ISPs would be willing to make data files
available containing <timestamp, source IP, #addresses, spam-flag> tuples
available for a week or so worth of traffic, then it would be quite 
interesting.

The spam flag could come from, say, spamassassin, and wouldn't have to be
all that accurate to get some useful data.

An analysis of such data files, augmented with guesses made from reverse
dns lookups, might classify the sources of spam and their time-domain
characteristics.

Aside from spam,  it would be mighty fun to know about the worldwide
source destination traffic matrix for email.

-Larry

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 11 Mar 2003 11:31:36 -0700 (MST)

> from: [email-masked]

> ...
> from all sources? ...

http://www.dcc-servers.net/dcc/graphs/ says that the flow of
spam is remarkably smooth.  It's the legitimate traffic that is not.

On the other (albeit anecdotal) hand, my traps get mostly Eastern
Hemisphere spam when the Western Hemisphere is asleep and vice versa.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg