Wiz's Computer and Website Security Blog

Following two weeks with no change in my level of spam, this week's levels have declined significantly. Spam for counterfeit watches led the pack by a 10% margin. This was followed by counterfeit Viagra-Cialis, various illicit pharmaceuticals, and male enhancement scams. The Nigerian 419 scammers and Russian bride scams had a measurable percentage this past week.

Spammers depend on the cheap use of millions of infected PCs that have been involuntarily made zombies in spam botnets. As authorities shutdown one botnet another rises to claim their share of the spam pie. As the number of infected machines declines, due to the owners being made aware of their problem and disinfecting their computers, the bot herders use whatever means is available to them to regain zombies in their herds. Sending fake delivery notices with bot installers is one of the favorites of malware distributors.

You still need spam protection and it is showing signs of getting worse again. MailWasher Pro is the program I use to detect and delete spam. My spam statistics are obtained from the program, showing how effective it is as a spam fighting tool.

This past 7 days, spam for various types of garbage amounted to 31% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from April 18 - 24, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 31%; -10% from last week
Number of messages classified as spam: 166
Number classified by my custom spam filters: 152
Number and percentage of spam according to my custom blacklist: 0
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 2
Number of spam messages seen, reported to SpamCop & manually deleted: 9

The order of spam categories, according to the highest percentages, is as follows:

Counterfeit Watches: 36.36%
Fake Viagra and Cialis: 26.62%
Pharmaceuticals and illegal prescription drugs: 14.29%
Male Enhancement scams: 10.39%
Pills filter: 3.25%
Nigerian 419 scams: 2.60%
DNS Blacklist Servers: 1.30%
Subject All Caps (mostly 419 scams): 1.30%
Other Filters (with small percentages): 1.30%
Russian Bride Scams: 1.30%
Subject Contains E-mail Address: 0.65%
LACNIC Senders (South America): 0.65%

This week I made 3 updates and/or additions to my custom filters:
Viagra Spam [S]
Misspelled Viagra [S]
Replica Watches


There was one false positive last week, which led to me adjusting the Watches filter. All other filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

Posted by Wiz at 11:44 PM | Permalink

back to top ^

Following last week's increase in spam, this week's levels remained the same. Spam for counterfeit watches led the pack by a 7% margin. This was followed by male enhancement scams and various illicit pharmaceuticals. The Nigerian 419 scammers were back at work this week, accounting for a little over 2% of my incoming spam.

Spammers depend on the cheap use of millions of infected PCs that have been involuntarily made zombies in spam botnets. As authorities shutdown one botnet another rises to claim their share of the spam pie. As the number of infected machines declines, due to the owners being made aware of their problem and disinfecting their computers, the bot herders use whatever means is available to them to regain zombies in their herds. Sending fake delivery notices with bot installers is one of the favorites of malware distributors.

You still need spam protection and it is showing signs of getting worse again. MailWasher Pro is the program I use to detect and delete spam. My spam statistics are obtained from the program, showing how effective it is as a spam fighting tool.

This past 7 days, spam for various types of garbage amounted to 41% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from April 11 - 17, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 41%; no change from last week
Number of messages classified as spam: 219
Number classified by my custom spam filters: 203
Number and percentage of spam according to my custom blacklist: 8
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 1
Number of spam messages seen, reported to SpamCop & manually deleted: 10

The order of spam categories, according to the highest percentages, is as follows:

Counterfeit Watches: 28.77%
Male Enhancement scams: 21.23%
Pharmaceuticals and illegal prescription drugs: 14.62%
Pills filter: 14.62%
Fake Viagra and Cialis: 7.55%
(.BR, .CN, or) .RU domain links: 3.77%
Blacklisted senders (my list): 3.77%
Other Filters (with small percentages): 1.42%
African Senders (usually 419 scams): 1.42%
Nigerian 419 scams: 0.94%
Known Spam [From]: 0.94%
Re: [digits] spam filter: 0.47%
DNS Blacklist Servers: 0.47%

This week I made 6 updates and/or additions to my custom filters:
E-Card Scam,
Nigerian 419 Scam #3 [S, F, R] (2x),
Re [digits] Spammer (2x),
Viagra Spam [B]


There were no false positives last week. All filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

Posted by Wiz at 2:50 PM | Permalink

back to top ^

Why you need to implement an anti-spam filter

Spam is defined as unwanted communication sent in bulk to multiple recipients and, most often, with some commercial or fraudulent purpose in mind. Spam most commonly reaches your network through the inbox.

While it is just an annoyance for the home user, an organization that doesn't have some form of anti-spam filter will quickly become inundated with unwanted electronic communication. This does not only clog up email inboxes, it also poses a security threat to both the employees and the company they work for.

The need to manage and control spam

Among the reasons to employ an anti-spam filter within the organization are:

1. Productivity - Time is money, and when employees are required to filter out junk email manually, this affects their level of productivity and increases the risk that genuine email may be lost in the process. Without an effective anti-spam filter, the amount of unsolicited email they are dealing with could be high.
2. Malicious Software - The possibility of malware infection should not be underestimated either. Many spam emails come with malicious payloads or poisoned links to infected websites and the last thing your organization needs is a malware infection - Trojans, keyloggers are among the nasty things circulating in email. The risk that malware picked up from spam email could cause problems on the company network, leading to data corruption and/or data loss, should be a good enough reason to deploy an anti-spam filter.
3. Fraud - This is another strong issue with spam as some unwanted email messages will attempt to phish personal or private information about you, other employees or you're the organization itself. Not only can this result in data loss and confidential data leaks, but it may also lead to company credit card fraud and the like.

Choosing the right anti spam-filter

Before investing in an anti-spam filter, it is good to know what's available so as to be sure your organization is benefiting from the latest anti-spam technologies. Below are some of the anti-spam filter solutions you might want to consider:

1. Hosted anti-spam - A hosted anti-spam filter offers several benefits, such as saving bandwidth due to spam mail never even being delivered to the organization's network. There is also no need to purchase server hardware or pay for software licenses or support as these will be included in the monthly plan. Hosted anti-spam filters also offer scalability and compatibility with different operating systems.
2. On-premise anti-spam - Some of the most popular anti-spam filtering products are server-based. Such a solution will often be found on the same hardware as the email server and its main advantage is the level of control it gives your organization in terms of configurability and integration with your email server.

Reclaim your inbox

Spam is inevitable, and organizations should understand that not doing anything about the problem will affect the server's performance, impact on employee productivity, as well as expose the business to some serious security threats. This can be prevented through user education on what spam is and how to identify it, not responding to or opening links in spam emails and, most importantly, using a robust anti-spam filter.

This guest post was provided by Lee Munson on behalf of GFI Software, a leading software developer that produces network and messaging security solutions for SMBs. More information about GFI anti-spam solution can be found at http://www.gfi.com/mes

Posted by Wiz at 3:17 PM | Permalink

back to top ^

Following last week's slight drop in spam, this week's levels increased by 6% (of my incoming email). Spam for counterfeit watches led the pack by a 19% margin. This was followed by pharmaceuticals of the usual type. Also, there was a noticeable barrage of malware infected spam claiming to come from Express Services and Postal Express. I hope that none of my readers were curious enough to open one of the attachments from these fake courier scams. If you did, your PC is now probably a member of a botnet.

Spammers depend on the cheap use of millions of infected PCs that have been involuntarily made zombies in spam botnets. As authorities shutdown one botnet another rises to claim their share of the spam pie. As the number of infected machines declines, due to the owners being made aware of their problem and disinfecting their computers, the bot herders use whatever means is available to them to regain zombies in their herds. Sending fake delivery notices with bot installers is one of the favorites of malware distributors.

You still need spam protection and it is showing signs of getting worse again. MailWasher Pro is the program I use to detect and delete spam. My spam statistics are obtained from the program, showing how effective it is as a spam fighting tool.

This past 7 days, spam for various types of garbage amounted to 41% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from April 4 - 10, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 41%; up 6% from last week
Number of messages classified as spam: 270
Number classified by my custom spam filters: 256
Number and percentage of spam according to my custom blacklist: 0
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 1
Number of spam messages seen, reported to SpamCop & manually deleted: 24

The order of spam categories, according to the highest percentages, is as follows:

Counterfeit Watches: 28.4%
Pharmaceuticals and illegal prescription drugs: 19.07%
Male Enhancement scams: 15.562%
(.BR, .CN, or) .RU domain links: 14.79%
Courier Spam (botnet Trojans in attachments): 6.23%
Fake Viagra and Cialis: 3.89%
Weight Loss Scams: 3.89%
Other Filters (with small percentages): 2.33%
Pills: 2.33%
Counterfeit Goods (bags, jewelry): 1.95%
Russian Bride Scam: 1.17%
DNS Blacklist Servers: 0.39%

This week I made 3 updates and/or additions to my custom filters:
Courier Scam #7 (2x),
Weight Loss Drugs


There were no false positives last week. All filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

Posted by Wiz at 4:54 PM | Permalink

back to top ^

Following last week's big increase in spam, this week's levels dropped slightly, by 3% (of my incoming email). I know that the various honeypot bean counters say that spam is down by between 30 and 40 percent, following the takedown of the Rustock Botnet, but that's not what my statistics reveal. Spam for counterfeit watches led the pack by a ~17% margin.

You still need spam protection and it is showing signs of getting worse again. MailWasher Pro is the program I use to detect and delete spam. My spam statistics are obtained from the program, showing how effective it is as a spam fighting tool.

This past 7 days, spam for various types of garbage amounted to 35% of my incoming email. This is according to MailWasher Pro, which I use to screen incoming email before downloading it to my desktop email program (Windows Live Mail). I report any spam messages that make it through my auto-delete filters to SpamCop.

Here are some statistics regarding the spam received and categorized, from March 28 - April 3, 2011. These classifications are based upon my own custom MailWasher spam filters. Most of this spam is automatically deleted by MailWasher Pro and my custom filters. The statistics are obtained from the program's logs.

Statistics Overview

Percentage classified as spam: 35%; down 3% from last week
Number of messages classified as spam: 183
Number classified by my custom spam filters: 172
Number and percentage of spam according to my custom blacklist: 1
Number classified as spam according to DNS Blocklists (SpamCop, Spamhaus, etc): 1
Number of spam messages seen, reported to SpamCop & manually deleted: 25

The order of spam categories, according to the highest percentages, is as follows:

Counterfeit Watches: 37.93%
Pharmaceuticals and illegal prescription drugs: 20.69%
Male Enhancement scams: 8.62%
Other Filters (with small percentages): 7.47%
Pills: 5.75%
Fake Viagra and Cialis: 4.60%
Counterfeit Goods (bags, jewelry): 4.60%
.BR, .CN, or .RU domain links: 3.45%
Courier Spam (malware in attachments): 2.87%
African Sender: 1.72%
PDF Attachment: 1.15%
Blacklisted sender names and domains (my blacklist): 0.57%
DNS Blacklist Servers: 0.57%

This week I made 8 updates and/or additions to my custom filters:
Courier Scam #7 (2x),
Diploma Spam,
Lottery Scam,
Post Express (2x),
Work At Home Scam.
New filter: Known Spam Subjects #4


There were no false positives last week. All filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2011 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

Posted by Wiz at 2:39 PM | Permalink

back to top ^