Forgot your password?
typodupeerror

Spam Volume Jumps 35% In November 371

Posted by CowboyNeal
from the crazy-email-subject-lines dept.
gregleimbeck writes "Spam volume soared another 35% in November, an e-mail security vendor said Thursday, and the month saw spam tactics that reduced the efficiency of traditional anti-spam filters. 'There's been a huge increase in spam volume,' says David Mayer, a product manager at IronPort Systems, 'from 31 billion spams a day on average in October 2005 to 63 billion in October 2006. But in November, we saw two surges that averaged 85 billion messages a day, one from Nov. 13 to 22, the other from Nov. 26 to 28.'"
This discussion has been archived. No new comments can be posted.

Spam Volume Jumps 35% In November

Comments Filter:
  • by twiggy (104320) on Thursday December 21, 2006 @07:54PM (#17331826) Homepage
    Maybe it's just me, but my spam volume seems to have jumped at least 200% in recent months.

    Are we finally going to reach a point where only trusted addresses can email us? Seems the arms race is being severely lost. I've got a pretty good spamassassin config and I can't keep up anymore, I find myself having to manually delete literally hundreds of messages a day now.
    • by sam_paris (919837) on Thursday December 21, 2006 @07:57PM (#17331848)
      i'd say try a different webmail provider. I get a LOT of spam per day, (about 100+) and 99.9% is categorised at spam by gmail. In the last month i would estimate i've had 2 spam messages hit my actual inbox. The rest were filtered out by gmail.
      • by epiphani (254981) <{ten.lad} {ta} {inahpipe}> on Thursday December 21, 2006 @08:14PM (#17331988)
        You're missing the point - the spam rate is BEFORE filtering, not after.

        I got around 100 per day back a few years ago. When i started forwarding to gmail, I average a spam folder of 4000 (it deletes spam after 30 days).

        In the past two months, its gone from between 5000 and 6000 to over 15,000. I would agree, hella higher than 35% though. At my place of employment, we have a million mailboxes. We started running into a lot more problems with spam than usual about 6 weeks ago as well.
        • Not that it changes your point - but I would hazard a guess at you being a webmail provider, given that the only company to exceed a million employees (well, and make it onto the Largest Companies By Revenue [wikipedia.org] list on WP) is Walmart - and I'd make a guess that all those shopfloor associates don't have their own @walmart.com address...
      • by a16 (783096) on Thursday December 21, 2006 @09:02PM (#17332410)
        Something worth pointing out to people who don't want to use gmail, is that you can use gmail as an enterprise grade anti-spam filter for your personal inbox.

        Simply forward all of your mail on to gmail, and then either collect it from gmail using POP3, or set gmail to forward it back to a "clean" account on your server that you can pick mail up on. You can set gmail to delete the mail after it forwards it, so you essentially get one of the best anti-spam filters out there, for free.

        Of course, what is annoying me is all of the penny stock image spam that gets through most spam filters. It's getting to the point where I really am considering stripping image attachments from messages. See this post [slashdot.org] further down for a bit more on my thoughts on image spam.
        • Re: (Score:3, Insightful)

          by gknoy (899301)
          Can you REALLY trust GMail to Really Truly Delete the contents of your mail? I don't.
    • Re: (Score:3, Interesting)

      by mcrbids (148650)
      I'm using greylisting and a number of RBLs, including DUN and SpamHaus.

      I see perhaps a dozen or so spams/day despite my email address being plastered all over the Intarweb for the last 6 years. (I've made no effort to hide it)

      This combination stops a ridiculous percentage of all inbound email.
    • by cliffski (65094) on Thursday December 21, 2006 @08:00PM (#17331878) Homepage
      I use (amongst other thing) spamhilator. It's free, and its pretty reliable. The trouble I have is that I *have* to allow everyone to mail me. When you run a business, you *do* occasionally get people guessing your email address from your domain and sending you a potentially vital email. I just can't afford to block emails by default. And anything (like captchas or auto-response systems) that makes it hard for my customers to contact me is just BAD.

      I don't see why we are always fighting this problem at the reception end, rather than the source. Spam filters can work quite well, but why are they mostly applied right at the very endpoint of the chain?
      I'd be very happy for some basic filtering to take place on my outgoing mail at the ISP level. If it meant the odd automatic email with a captcha saying "are you sure you intended to send this mail?" before a spammy-looking email went out, thats fine with me, and wouldn't that approach cut down on all those twits whose PC's are part of a botnet without them realising it?

      Bah, why is firefox suddenly getting me to spell check in American?
      • by khasim (1285)
        #1. Aggressively whitelist - since I have the records of all the email received I can just send my users a list of all the email addresses that have sent mail to them and they can pick out the legitimate addresses.

        #2. Block email during SMTP transmission - this is where the whitelists and blacklists come in. Everything else gets greylisted. I also use fake addresses to create my own blacklists.

        If something is rejected, my phone number is included on the rejection notice. A person will see it and can call.

        #3
        • Re: (Score:3, Insightful)

          by whoever57 (658626)
          If something is rejected, my phone number is included on the rejection notice. A person will see it and can call.
          I don't know why it is, but I have found that many quite intelligent people are utterly incapable of reading rejection notices.
        • by Nogami_Saeko (466595) on Thursday December 21, 2006 @09:10PM (#17332468)
          I'm running my own mail server and using a system I read about which delays the initial SMTP "HELO" for 20-30 seconds before acknowledging the incoming connection.

          If someone is sending spam, they're not going to wait that long before starting a new connection (it would slow them down something fierce, to maybe only sending 1 or 2 emails a minute).

          This catches about 75% or more of the spam coming in - anything left is mopped-up by either spam assassin at the mail server level, or POPFile before my email client.

          Sort of a 3-tiered approach. Very little (maybe 1 or 2) spams per-week get through.

          N.
        • An important feature that is used by the spammers to verify that the email has been sent and read is external
          images, if you completely block those they cannot use the servers statistics/unique session id to figure out
          which mails worked or didnt.

          2. Use those remote image location to flood their session stats and pollute their databases and tell their ISPs to drop them too.
    • by tacocat (527354) <tallison1&twmi,rr,com> on Thursday December 21, 2006 @08:02PM (#17331898)

      Even that can be spoofed. And people will complain that they can't engage the customers and that's hurting the economy.

      There was a guy who proposed something called RSS-mail a few years back. It was the same guy who came up with SPF I think.

      Anyways the idea was that I would send you a notification that there was an email waiting for you to pick up on my server. Similar to how RSS passes data. If I was interested in reading that message I could call upon your server to deliver the email to me and then I could read it.

      The key is that now the sender has to own the email. He can't just shoot off 20 million random messages. He now has to store all of them on his server for some period of time so that you can pick them up. Cheap for you, expensive for him. It also means that he has to be honest about his RSS feed otherwise you'll never be able to pick up the email and read it. This also makes it easier to track them down.

      Personally, I think spammers won't go away easily. They make a lot of money off pathetic fucktards who think they can get a bigger dick with a pill. The real damage is done by the people who purchase via spam making spam a viable marketing tool.

      • You could still spam millions of emails with a scheme like this. Since the email "stored on the server" could be generated at run time, or just serve a single copy to millions of people. With such a horde of zombie machines out there, even the approach of "storing" emails on a server will not help.
        • Re: (Score:3, Interesting)

          by daeg (828071)
          Combined with an idea like Hashcash (although not a direct copy), you could send a computationally-intensive hash of the message body combined with the recipient's e-mail address. When the receiver picks up the message, the client can verify the notification hash with the message hash. If they don't match, throw the message away (or notify the user, etc).
      • by dgatwood (11270) on Thursday December 21, 2006 @08:37PM (#17332166) Journal

        That's definitely one approach. Unfortunately, it means that my mail would then be at the mercy of a thousand servers' bandwidth, and that reading my mail would take a lot longer on the average as a result.

        What we really need is E2EASMTP: End-to-end Authenticated SMTP. The design is basically just the existing SMTP. The only changes are as follows:

        1. All mail servers require an SSL key. This is assigned by the registrar when you purchase a domain. This key may be shared among multiple hosts within the same domain.
        2. All mail servers must require SMTP-Auth for outbound traffic.
        3. All mail servers must sign each piece of mail as it passes through their systems. This signature must sign the complete message, including the signatures of previous servers in the path.
        4. All mail servers must support an automated abuse handling mailbox, autoabuse@domain for responses to spam messages.
        5. All mail servers must forward automated abuse messages appropriately by verifying its own email signature (sending an abuse bounce-back if it does not match) and then forwarding the abuse report to the mail server that send the message to it in the first place.
        6. Upon receipt of a certain number (determined as a site policy) of reports of spam or other junk emails from a given user, the mail server should automatically email that user to notify him/her that his computer is compromised and block any and all emails from that user until it is reset.
        7. All ISPs should take reasonable care not to reinstate mail sending privileges until they are sure that the user's computer is clean.
        8. ISPs are encouraged to manually look at any blocked accounts as soon as they become blocked to make sure that the messages really are spam/phishing.

        The key is that the entire abuse reporting process should be automated and that no email messages without an initial host signature should be delivered. This will make it impossible for continued operation of spam zombies in two ways:

        1. It will prevent them from sending mail directly by running an SMTP server on the compromised computer.
        2. It will prevent them from continuing to send mail through an ISP's mail server by ensuring that the mail messages can be traced back to a single individual user of the originating ISP, where the messages will be automatically blocked in a timely fashion.

        In effect, by ensuring a trusted (albeit not necessarily encrypted) path for all email messages, you make spamming orders of magnitude harder with minimal performance impact. Best of all, I think that this could be implemented with relatively minor additions to the SMTP protocol and phased in over a period of time, ensuring a smooth transition from the spam nightmare we have now to a more modern, usable email infrastructure.

        • by shadowmas (697397) on Thursday December 21, 2006 @09:38PM (#17332674)
          this is an excellent idea. but rather than having the registrar generate the SSL keys why not add them to the dns like in spf. this would allow the admins to generate the keys the way they want and if somehow a key is compromised (one of the mail servers gets stolen/hacked) they can quickly and easily generate a new key. also it would be valuable if you could have different keys for different servers.
        • by nuzak (959558) on Thursday December 21, 2006 @09:48PM (#17332742) Journal
          I could analyze your FUSSP point-for-point, but let me just whack at the most flawed point:

          All ISPs should take reasonable care not to reinstate mail sending privileges until they are sure that the user's computer is clean.

          Any ISP that actually gives enough of a shit to care what is coming out of their network and manage their users like this has already managed the spam problem. How much spam do you see coming from AOL IPs? Yeah, it's because they got people like Carl Hutzler who actually took the problem seriously and they gave him real power to implement solutions.

          I see armchair admins come up with these oh-so-clever solutions every day, but the reality is that solutions exist now, and what stands in the way of their implementation is nothing more than incompetence and greed. Comcast, Brazil Telecom, Orange/TPnet, all of them could stop their massive armies of zombies overnight, but it's just too expensive. Their cost-benefit analysis lets them keep polluting our mailboxes with direct-to-MX zombie connections rather than deal with the support costs of the 0.01% of users that will ACTUALLY have a problem with port-25 blocking.

          We have to make it expensive for ISP's to continue letting their zombies send us spam. That is my FUSSP.

        • Re: (Score:3, Funny)

          by Darkforge (28199)

          What we really need is E2EASMTP: End-to-end Authenticated SMTP.


          Your post advocates a

          (x) technical ( ) legislative ( ) market-based ( ) vigilante

          approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

          ( ) Spammers can easily use it to harvest email addresses
          ( ) Mailing lists and other legitimate email uses would be affe

      • Re: (Score:3, Insightful)

        by Just Some Guy (3352)

        This comes up a lot, so skip this if you've read my take on the matter before.

        One of my clients has a website that features an opt-in email newsletter. Each message is roughly 1MB in size (many pages, lots of images, etc.). He has about 25,000 subscribers. This means that near the first of each month, he's sending about 25GB of email out to people who want to get it. Under SMTP, this is no big deal - just give Postfix a list of recipients, and let it work out the delivery details. The mail queue grad

    • Re: (Score:3, Interesting)

      by jrumney (197329)

      No, its not just you.

      I've always preferred to run my own spam filters, I trust myself not to filter out a genuine email by mistake more than I trust my ISP, but last week the spam level got to the point where I'd go away for a couple of hours and there would be 200 new spams in my Junk folder, so I enabled the filter in my ISP's mail settings to try to get some bandwidth back. But as this article said, the latest batch seems to be evading conventional filters, so I'm still buried and thinking along whiteli

    • Re: (Score:3, Interesting)

      by CodeBuster (516420)
      I have noticed this as well and so have my friends and family. In fact, the number of daily spams caught and trashed by my Spam Bayes [sourceforge.net] filter has nearly tripled in the last six months. The probable cause of this increase is a recent surge in the number of zombies now controlled by spam trojans in the bot networks. This was covered here on Slashdot last month in Bot Nets Behind Recent Spam Surge [slashdot.org]. As for the trusted email addresses, some of us are already doing this with whitelists, but as you say the good guy
    • I'd be most interested to know if spammers' revenues are going up accordingly. Perhaps their market has been tapped by their previous efforts, and there are no more stupid people to reach.

      Yeah, wishful thinking I know... I'll go to my corner now.
    • Re: (Score:3, Informative)

      by YGingras (605709)
      Kick spamassassin, rules based filters are not what you need to keep-up. Install greylistd and spamoracle. No more than 0.5% of the spam hits my inbox. Spamoracle will detect anything that isn't an image. Greylistd for some reason kill 99% of the images. Yeah spamers are lame and they could get around this setup but for now you have a pretty good solution that will take 30 mins to setup.
    • Re: (Score:3, Funny)

      by clem (5683)
      Maybe it's just me, but my spam volume seems to have jumped at least 200% in recent months.

      Ah, but my spam volume decreased by 130%. So it all works out, you see?
    • Authentication (Score:3, Interesting)

      I saw a huge increase in spam stats also. I currently get around 11000 messages a day. But I only have to manually delete 1 or 2 a day. My customers enjoy the same convenience despite 100000+ spams a day to their company. There is no administration of filter rules. I run my own filter software (pymilter [sourceforge.net]) on a 600Mhz celeron with 256M ram. My content filter is quite old (dspam-2.5.6.2 with pydspam).

      The secret is that I reject all but a few hundred of those 11000 spams in SMTP envelope. Correspondent

  • Pump & dump for PHYA (Score:5, Informative)

    by gvc (167165) on Thursday December 21, 2006 @07:56PM (#17331838)
    It appears to me that the increase is almost all due to a small number of messages swamping us. One advertises the stock symbol PHYA and has no link. The scam is that if you Google for that symbol, there will be a full-width paid ad for a fake broker/analyst site. About 10% of my email for the last couple of weeks (i.e. over 100 of 1000 spams/day) advertises this stock symbol.
    • by gvc (167165) on Thursday December 21, 2006 @07:59PM (#17331864)
      P.S. Feel free to Google PHYA and click the ad. It costs them money.
    • by cashman73 (855518) on Thursday December 21, 2006 @08:08PM (#17331944) Journal
      Stock ticker PHYA belongs to Physicians Adult Daycare, Inc. They recently put out this announcement [yahoo.com] saying that they have nothing to do with the email spammers, and are trying to catch them.

      Basically, the way this scam works is that the scammers buy a bunch of worthless stock (as in a few cents/share), then email fake stockbroker advice websites and fake advice emails to people, trying to get them to buy the stock. When the stock is worth a decent amount of money, the scammers sell and leave everyone else that bought into their so-called, "advice," with worthless stock.

    • Its a constant battle against that pumper: (here is my spamassassin user_pref for them)

      body __LR_PUMP_A /Symbol:/
      body __LR_PUMP_C /Short-Term Projected Price:/
      body __LR_PUMP_D /Long-Term Target Price:/
      meta LR_PUMP_1 (__LR_PUMP_A && __LR_PUMP_C && __LR_PUMP_D)
      score LR_PUMP_1 5.0

      body LR_PAD_1 /Physician Adult Daycare/
      describe LR_PAD_1 Physician Adult Daycare
      score LR_PAD_1 5.0

      H.
    • I am also trying to see a way for the mkts to help combat this. The pink sheet market can help here. If spam for a symbol on their market reaches some predefined high water metric, remove the symbol from trading for one week. Another alterative is to allow short selling on the thinly traded issue. The pumper has already taken a position and is most likely the reason why the ask price is so high when the emails start arriving. Shorting would be a clear brake here on exuberance. Once the symbol is out of play
  • Plus, SMS Spam (Score:4, Interesting)

    by SRA8 (859587) on Thursday December 21, 2006 @07:57PM (#17331842)
    If it wasnt bad enough get 10 to 15 stock "tips" via spam a day, in mid-December, i started getting the same stock spam via SMS! Yes, SMS! I got a burst of 6 one morning, then another 5 later in the day. Theres $1.10 of SMS fees courtesy of Cingular. I cancelled my SMS service (which they enable automatically) immediately. Wonder how many people are unknowing getting charged for these messages. Starting January 07, Cingular will start charging 0.15/sms -- perahps a response to record SMS revenues :-) ?
    • Re: (Score:3, Interesting)

      by j00r0m4nc3r (959816)
      I wouldn't be surprised if Cingular was behind it
    • Re:Plus, SMS Spam (Score:4, Informative)

      by QuantumRiff (120817) on Thursday December 21, 2006 @08:31PM (#17332124)
      Cingular charges for incoming SMS? Wow, my cell phone company, as well as all the others I know of in my area (no cingular) only charge for OUTGOING SMS messages.. Just for that reason! Cause pretty much any spammer can send an email to 1234567890@email..com and have the email forwarded as an SMS to your phone..
    • Re: (Score:3, Informative)

      by Alioth (221270)
      You get charged for *incoming* text messages? Ye gods! Run, don't walk - to a better cell phone provider who doesn't rip you off for what is essentially almost a penny a byte.
  • Works great, even though some spams get through they do seem to identify and eliminate quite a bit of spam.

    I'm still worried why so much spam recently though. Is there anyone out there who seriously READs this garbage and actually considers sending money to these people? Seems like the problem with spam is only going to get worse and worse until the big email providers can come up with some mechanism to prevent spam that still allows independent non-business email servers to still serve their purpose. I
    • by tacocat (527354)

      Yes. They made several billion dollars from spam related sales last year. If it can generate that much sales do you really think it will go away? Ever?

    • Who reads it? (Score:5, Insightful)

      by Kelson (129150) * on Thursday December 21, 2006 @08:10PM (#17331958) Homepage Journal
      Is there anyone out there who seriously READs this garbage and actually considers sending money to these people?

      The great irony of the spam arms race is that the better we get at filtering the spam, the more garbage the spammers send out just to get the same return. You can't stop filtering it, because the mail you want would be buried in a torrent of spam. But filtering more just raises the bar for the next round of spam.

      Eventually it may get to the point where (a) email is unusable or (b) spammers have to send such a massive volume of cr@p that it no longer becomes a cheap business, and it ceases to be worth spamming. Until then, things will keep escalating.

      • Re:Who reads it? (Score:5, Informative)

        by SQL Error (16383) on Thursday December 21, 2006 @08:22PM (#17332042)
        Most spam is sent out using hijacked Windows PCs - zombie networks - and costs the spammers nothing. So they ain't gonna stop.

        Having said that, the level of obfuscation they have to use even now makes their ads almost unreadable. You want me to 3nl@rg3 my what?
        • by Kelson (129150) *

          Most spam is sent out using hijacked Windows PCs - zombie networks - and costs the spammers nothing.

          Well, it doesn't cost them more in terms of bandwidth, but I understand there's a thriving black-market business in selling access to the botnets.

          Having said that, the level of obfuscation they have to use even now makes their ads almost unreadable. You want me to 3nl@rg3 my what?

          Yes, obfuscation, at least, seems to be one tactic they've embraced that ought to be self-defeating.

  • by illuminatedwax (537131) <stdrangeNO@SPAMalumni.uchicago.edu> on Thursday December 21, 2006 @08:03PM (#17331904) Journal
    "Two years from now, spam will be solved" - Bill Gates
  • Outlook (Score:2, Informative)

    I'm no MS fan, but I have to admit, a quick bit of maths show that Outlook gets over 95% of my spam. Gotta hand it to them.
  • Spam has had a tendency to spike around election time for one reason or another.
    Not to mention this is the 4th quarter, when everyone and his cousin is trying to
    sell holiday gifts. How about some data for the past 6 months?
  • White List. (Score:3, Insightful)

    by headkase (533448) on Thursday December 21, 2006 @08:07PM (#17331936)
    Well I'd just switch to a white list of e-mail addresses and everything else be damned! Captcha based filtering for application to join my white list if I wanted it too.
  • by AaronW (33736) on Thursday December 21, 2006 @08:12PM (#17331974) Homepage
    Spam has become such a problem where I work that it has completely flooded the corporate Internet connection. I personally feel they should host an external mail server and spam filter off-site someplace. For my personal server I use various RBLs and country blacklists, like blocking all of China, Korea, Russia, Nigeria and a few other countries. Those seem to block most of the spam from even entering my mail server.

    I know people talk about legal solutions not working, but I think if law enforcement made use of existing laws and went after these people it might make a difference. I'd love to see the FTC go after the pump and dump spammers and confiscate everything they own before locking them up, or the food and drug administration go after all the enhancement pill spammers. Also, perhaps a law to fine idiots who buy from these spammers.

    Just change the federal law to let some of the state laws take effect, i.e. defeat the Can-spam act.

    I think if law enforcement made a good effort to go after these spammers and lock them up then it might make a difference.

    -Aaron
  • Bandwidth (Score:5, Interesting)

    by tef (1042040) on Thursday December 21, 2006 @08:13PM (#17331984)
    If for example each spam message was around 1k of info, that's on average 63 tera bytes of info! Using the new Seimans 107gb speed record connection, that would take almost 10 minutes to transfer all that spam! I just wonder how much faster the internet would be without spam.
    • by Shados (741919)
      I was about to post the same thing. Honestly, it is time email gets banned from the net altogether or something. All these problems come from an obsolete protocole that was created in the days before we realised just how the internet would be abused. As useful as email can be, it has to be replaced, even if its by something less useful. All that spam is definately slowing down the internet.

      Yeah, spammers will just move to the next thing...but we have to work our way up. Email is slowly becoming useless now.
    • by AaronW (33736)
      My Internet access at work would go a *lot* faster. Spam has managed to fill the entire 8Mbps pipe, completely saturating the link, 24 hours a day. It's not a very large company either.

      -Aaron
    • Re: (Score:3, Interesting)

      by Dunbal (464142)
      I don't know about YOUR spam, but I just looked at my mailbox. You're off by a factor of about 20 as far as size is concerned. My average size for spam is around 20kb (out of 30 spam messages in my bulk mailbox). Now let's say we pretend that the entire internet is running at 107Gbs - which is not true, this was an experimental situation - we're talking 1260 Tb. Assuming your calculation is correct this would take 200 minutes, not 10 minutes. There are 1440 minutes in a day, so 200/1440 = 14% of the day is
  • by Doc Ruby (173196) on Thursday December 21, 2006 @08:21PM (#17332038) Homepage Journal
    And that's why the US Treasury announced a surplus, from all the fines collected from all that spam violating the CAN-SPAM Act. We're funding free WiFi for every American, while exterminating all the spammers!
  • I know there's instant messaging, but I think the way of messaging by e-mail also has its place. Maybe it's time for a standardizing organization to pick up on this with a new "e-mail"-like standard and try get it backed by a lot of software company software. It could be with e.g. HTML, can it be done again, or do the current companies carry too big egos, only believing in their own solutions? There was some hope with both Google and Yahoo using the Domain Keys initiative, but since it's so little supported
  • by caller9 (764851) on Thursday December 21, 2006 @08:23PM (#17332050)
    If you don't do business outside the US, filtering by geographic registration for the subnet works wonders. A little hard to set up but once you use the geographically filtered email to train your Bayesian filter, you really get 99.9% or better. Currently getting approx 99.97% accuracy and very little false positives. Pleased as punch.
    • by AaronW (33736)
      Several years ago I found a RBL that works by country. For example, I use cn-kr.blackholes.us which effectively blocks all of China and Korea.
      Also, the following code will grab all the subnets by country, this example grabs them for China:

      #!/usr/bin/perl
      $ctry = shift || 'cn';
      $_ = `wget -O - http://www.apnic.net/apnic-bin/ipv4-by-country.pl? country=$ctry`;
      print join "\n", /([0-9\.]+\/[0-9]+)/g;
  • Scum (Score:4, Interesting)

    by skinfitz (564041) on Thursday December 21, 2006 @08:33PM (#17332144) Journal
    Spammers are scum. Introduce the death penalty for them - I'll gladly throw the switch, however I would argue a new extra painful method of execution should be devised just for them.
  • Although there are many very effective antispam techniques, some common methods are worse than the problem they are attempting to solve.

    Content filters are code that effectively say "I know spam when I see it." Given that people can't say exactly what spam is, why would they trust code written by humans to do the same. Likewise, blacklists are dangerous. We have a mail list machine that hosts hundreds of thousands of subscribers. A lot of people classify any email they don't want as spam, so we occasionally
    • The assertion that a program must make as many mistakes as the human that programmed it is preposterous. I daresay I can write a program that computes a million sums and it'll get more of them right than your average human.

      Content-based spam filters can be much more accurate than humans. In particular, they can have lower false positive rates. That is, a good spam filter is less likely to discard good email than a human is to overlook good email in a sea of spam.

      I'm not exactly sure how the article s

  • I'm not so sure what everyone is complaining about. I'm using SpamSieve [c-command.com] as a plug in to Mail.app, and it catches just about everything without much in the way of training. Currently, my statistics as of 2006-11-01 say it's 97.1% accurate (with 71% of my total mail volume being spam, but that includes some legitimate marketing mail that I no longer really want, and I'm too lazy to track down the list maintainers), and that number gets higher every day.

    On Windows, I'm using either Mozilla Thunderbird (usuall
  • by Ranger (1783) on Thursday December 21, 2006 @08:38PM (#17332184) Homepage
    I'm sure that it'll go back down to normal levels real soon now. Why heck, it may even withdraw from the Internets.

    --
    My God! It's full of tubes!
  • In october and november the volumes have rocketed. There was a weekend alone where I saw over 80000 messages being trashed. At some point procmail was too slow to digest the message as they arrived and I had to install a hook to "help".

    Here are my monthly stats for over the last year on my own personal domain, that has the unfortunate privilege to be in every blasted spam file ever.. These are pre-rejected spams, some still pass to the "next level"...

    http://oomz.net/spam-monthly.png [oomz.net]
  • by Duncan3 (10537) on Thursday December 21, 2006 @08:59PM (#17332376) Homepage
    Content-Type contains "multipart"
    or Content-Type contains "text/html"
    and not in address book.

    What those don't catch, along with a couple filters for non-english, Thunderbirds filters do. Haven't had a false positive yet. It gets all that image spam, and before that, it caught all that HTML. That same logic working in Mail.app.
  • by keeboo (724305) on Thursday December 21, 2006 @09:03PM (#17332412)
    We use Postgrey [ee.ethz.ch] to filter the spams out.
    It works wonderfully even without additional filtering (blacklists, for example.. Which we do still use, though).

    Postgrey is a grey-list system por Postfix (for a description on how it works, click here [puremagic.com]), and there are probably other good greylist filters around.

    We've had (like everyone else has) massive amounts of spam going through Spamassassin, our server was down its knees all the time.
    Now the machine is typically 95-98 percent idle and the spams we receive (remember I've said we use blacklists aswell) is only the ones which come from our intranet (from hijacked machines we quickly disable when discovered).
    That tool saved the day.

    Eventually those bastards will have a way around it, but for now it works very well.
  • by TropicalCoder (898500) on Thursday December 21, 2006 @10:28PM (#17333012) Homepage Journal

    The real disease is: those vast botnets. Really, it's a scary thought. We are lucky that they only being used for spam and the usual phishing scams and the like - as far as we know! Imagine if the terrorists buy themselves some botnets for some nefarious purpose, or the Chinese or North Korea government corner the market on them to run millions of bots to steal corporate secrets or IDs or who knows what? What I'm saying here is that the large increase in spam should be triggering off alarm bells everywhere. The spam is not the problem - it's the botnets. Why in the world don't responsible world governments unite to put a swift end to this problem? Really - it could be dealt with swiftly and effectively in a hundred different ways that I will up to the imagination of the reader. I am just astonished this hasn't happened. I mean - couldn't our friend and champion of democracy George W. include this in his initiative against terrorism? He would probably have more luck tackling this problem then he is having in Iraq. What if he put that on his agenda - and set loose all his military might along with the help of some coalition of the willing? Perhaps he could salvage what's left of his image? Are you listening Mister Bush?

    http://www.magma.ca/~gtaylor/AudioTestFileGen.htm [magma.ca]
  • Bring It On (Score:3, Funny)

    by JusticeISaid (946884) on Thursday December 21, 2006 @11:44PM (#17333428)
    I'm writing this from my chateau in France. I flew here earlier today from my horse farm in Virginia in my new Gulfstream. Can't believe my good luck: couple of months ago, I discovered this unsolicited stock tip in my email. The stock was cheap and the tip seemed pretty solid, so I invested my life savings in it. And my grandmother's life savings, too; I have her power-of-attorney. The next day, I got nervous. Remembered the old line about if it seems to good to be true, it probably is. So I decided to unload the stock. Damned if the price hadn't gone up 6000 percent! In one day! Incredible! Anyway, I sold it all ... and here I am. Grandma's taking a round-the-world tour in her Gulfstream -- we bought a matched pair.
  • by Lokatana (530146) on Friday December 22, 2006 @09:49AM (#17336296) Journal
    I run an enterprise level messaging department for a large financial institution.

    The increase in November of 35% is pretty accurate - but where the real story is is when you look at the 6 month trend.

    In July of 2006, my enterprise was blocking approximately 20 million spam messages per week. Last week, we blocked 86 million spam messages - over 400% increase in 6 months.

    Most of the growth occured in September & October. We're projecting to hit 100 million per week by the end of January.

    The only good news here is that the amount of valid email that we're letting into our enterprise is remaining flat, indicating that pretty much the entire increase is successfully blocked by our anti-spam. *whew*.

    -Lokatana

  • by BigJim.fr (40893) <jim@liotier.org> on Friday December 22, 2006 @10:44AM (#17336688) Homepage
    I now scrub mail for friends and familly through my Postfix mail server using Fetchmail, Fetchyahoo and Gotmail. Amavisd-new, Clamav, Spamassassin, various DNS blacklists includung URIDNSBL and a sprinkle of bayesian filtering have pretty much solved the problem as far as I'm concerned. The only remaining annoyance was image spam, but that has even been solved thanks to FuzzyOCR that is now in Debian ! [ruwenzori.net]

    I you still have spam, it just means that you are not using the freely available tools to eradicate it. Just do it ! I found it is suprisingly easy and we have to thank Debian for that !

"The geeks shall inherit the earth." -- Karl Lehenbauer

Working...