My spam analysis and spam filter updates, for Jan 9 - 16, 2012
I just compiled my personal spam statistics for the 2nd week of January, 2012 and found that spam accounted for about 40% of my incoming email. This is down 4% from the same period last year, but 1% higher than the previous week.
The leading category by a long shot was for the fake ClubVIP Casino. There is no website with such a name, just a bunch of various recently registered domain names that all point to fake casino pages. As was the case last week, these casino pages display an image that is wrapped in a hyperlink, which leads to the downloading of a suspicious executable. Once you install that file, you will part with a lot more money than if you shot craps at a real casino.
The second highest spam category was for fake (replica) watches, followed by counterfeit Cialis and Viagra. All other categories had smaller percentages, as outlined in my extended comments.
These spam statistics are derived from MailWasher Pro, which is a POP3 email screening program that runs on a Windows desktop. It intercepts all incoming email and analyzes it, based upon several factors, the most prominent of which are my own custom spam filters.
Total incoming email from January 9 through 16 (4 PM EDT): 516
Good mail: 308
Classified as spam: 208
Percentage rated spam: 40.3%
Here is a breakdown of spam by category, for the week of January 9 through 16, 2012.
Casino spam: 24%
Replica Watches: 15%
Cialis and Viagra: 10%
Fake diplomas: 7.54%
Russian or Ukrainian spam domain links: 5.7%
Work at home scams: 5.7%
Pharmaceuticals spam: 4.8%
Weight loss scams: 4.8%
Miscellaneous other filters: 4.8%
Learning filter classed as Spam: 3.8%
Blacklisted (my blacklist): 3.36%
Unlicensed prescription drugs: 2.4%
Known Spam Domains: 1.9%
Russian Bride scams: 1.9%
Nigerian 419 scams: 1.9%
Male Enhancement scams: 1.44%
Malware link with fake query strings appended: 0.96%
I made the following additions or updates to my custom MailWasher filters
Counterfeit Goods,
Diploma Spam [B plain text],
Diploma Spam [B regexp],
Known Spam Domains (trlvi.com),
Male Enhancement [B],
Nigerian 419 Scam #3 [S, F, R],
URL Shortener (Spam) Link,
Work At Home Scam #1
The following wildcard email address was added to my MailWasher Blacklist:
[email protected].+
This wildcard account is being used by a persistent Nigerian 419 scammer and appeared in all of the 419 scams I received this week. The + sign in front of the @ means "anything"@potter.m.lawfirm plus any domain extensions (.com, .co.uk, etc).
I publish filters for both the old and new versions of MailWasher Pro. However, the new version allows for more lines of conditions than the previous ones. If you use a desktop application to send and receive POP3 email, MailWasher can act as a spam filter before you download email to your email client. You can learn more about the program, download a trial version, or purchase a subscription, at the MailWasher Pro website.
If you like this article please share it.
The content on this blog may be reprinted provided you do not modify the content and that you give credit to Wizcrafts and provide a link back to the blog home page, or individual blog articles you wish to reprint. Commercial use, or derivative work requires written permission from the author.