Global Spam Threat Report
A monthly report on global email threats and trends.
Powered by SpamStopsHere™
Global Spam %
Up 5 points
Top Spamming Country
U.S. > 20%
Average spam levels as a percentage of all email went back up during December, to about 68%. Much of that increase appears to be a surge in new campaigns toward the end of the month that were caught by our unique pattern filtering. The U.S. once again sent out more spam than any other country.
Monthly Alert: Mutating Spam
Spam percentages were actually rather low during much of the month, despite a few surges in the first and second weeks. However, our first four filters blocked a large amount of spam during the fourth week in what appears to have been a constantly morphing sustained campaign.
Global Spam Volume
Global spam percentages in December averaged around 68%, an increase of about 5 percentage points from the previous month.
Top 10 Spam Countries
The U.S. was once again the largest spamming country, with servers within its borders sending over 20% of global spam.
The previous month, spam from Romanian servers sent out over 14% of the total. Our preliminary analysis showed that was an anomaly. As expected, Romania dropped out of the top ten, sending out only about 2.5% of the world's spam in December.
Total Anti-Spam Filtering by Type
SpamStopsHere works differently from other antispam programs. Multiple filters accurately block spam based on different criteria.
Generally, the two most active filters are the IP Blacklist and URL/Phone filters. The IP Blacklist filter blocks spam from know spamming servers. The URL / Phone filter blocks emails that include "click-me" links to web sites or phone numbers owned by spammers.
Last month, however, our phrase and pattern filters were also quite active, indicating new or modified spam campaigns. The phrase filter looks for long phrases that we know are in spam (like "Cheapest V!agra on the Internet") and would never be in a legitimate email. When we see a campaign with new phrases, they are added to our database to block future messages.
Our 24/7/365 threat analysts also constantly update our pattern filters to recognize templates and html signatures from spammers, so we can anticipate their next move. With a new pattern filter in place, we identify new servers sending out the campaign and new "click-me" links being used in it. Then the IP and URL filters take over to block additional variations.
In the above chart, you can see a large sustained amount of spam during the fourth week of the month. This appears to be a spam campaign that morphed during the week, probably to prevent other antispam programs from blocking it. We had no problem keeping up with it.
- During the first day or so, the IP filter and phrase filters did the heavy lifting. So the spam may have come from known servers or had known spam phrases.
- Then on the second day, URL filtering increased dramatically, indicating spam with known URLs ("click-me" links) coming from servers that were not yet in our database.
- On days 4-7, pattern filtering took over, blocking a huge amount of spam. However, you can also see IP and URL filtering slowly climb, as the new sending IP addresses and click-me links were added to the database.
The campaign appeas to have continued past the fourth week. The phrase and pattern filters were back to normal levels, with the IP and URL filters doing most of the work, indicating we had successfully adapted to the new campaign while blocking it.
The data indicates that December saw a large mutating spam campaign during the end of the month. SpamStopsHere and our live threat review team kept right up with it through phrase and pattern filtering, until new IP adddresses and URLs were added to the database.
Thank you for reading the Global Spam Reports. We look forward to providing you with information in the months to come with our continuing coverage of global spam threats. To receive updates on the Global Spam Report automatically, click here to add our monthly reports on global spam threats to your RSS feed.