Global Spam Threat Report

January 2014

A monthly report on global email threats and trends.
Powered by SpamStopsHere

Executive Overview

Global Spam %

Up 5 points

Top Spamming Country

U.S. > 20%


Mutating Spam

Average spam levels as a percentage of all email went back up during December, to about 68%. Much of that increase appears to be a surge in new campaigns toward the end of the month that were caught by our unique pattern filtering. The U.S. once again sent out more spam than any other country.

Monthly Alert: Mutating Spam

Spam percentages were actually rather low during much of the month, despite a few surges in the first and second weeks. However, our first four filters blocked a large amount of spam during the fourth week in what appears to have been a constantly morphing sustained campaign.

Global Spam Volume

Global spam percentages in December averaged around 68%, an increase of about 5 percentage points from the previous month.

Global Spam Volume December 2013

The amount of global spam during December 2013 and the overall trend

Top 10 Spam Countries

The U.S. was once again the largest spamming country, with servers within its borders sending over 20% of global spam.

The previous month, spam from Romanian servers sent out over 14% of the total. Our preliminary analysis showed that was an anomaly. As expected, Romania dropped out of the top ten, sending out only about 2.5% of the world's spam in December.

Top Spam Countries - December 2013

The amount of spam during December 2013 from the top 10 spamming countries

Total Anti-Spam Filtering by Type

SpamStopsHere works differently from other antispam programs. Multiple filters accurately block spam based on different criteria.

Generally, the two most active filters are the IP Blacklist and URL/Phone filters. The IP Blacklist filter blocks spam from know spamming servers. The URL / Phone filter blocks emails that include "click-me" links to web sites or phone numbers owned by spammers.

Last month, however, our phrase and pattern filters were also quite active, indicating new or modified spam campaigns. The phrase filter looks for long phrases that we know are in spam (like "Cheapest V!agra on the Internet") and would never be in a legitimate email. When we see a campaign with new phrases, they are added to our database to block future messages.

Our 24/7/365 threat analysts also constantly update our pattern filters to recognize templates and html signatures from spammers, so we can anticipate their next move. With a new pattern filter in place, we identify new servers sending out the campaign and new "click-me" links being used in it. Then the IP and URL filters take over to block additional variations.

Spam Filtering Volume by Type - December 2013

The amount of spam blocked during December 2013 by SpamStopsHere's multiple filters

In the above chart, you can see a large sustained amount of spam during the fourth week of the month. This appears to be a spam campaign that morphed during the week, probably to prevent other antispam programs from blocking it. We had no problem keeping up with it.

  • During the first day or so, the IP filter and phrase filters did the heavy lifting. So the spam may have come from known servers or had known spam phrases.
  • Then on the second day, URL filtering increased dramatically, indicating spam with known URLs ("click-me" links) coming from servers that were not yet in our database.
  • On days 4-7, pattern filtering took over, blocking a huge amount of spam. However, you can also see IP and URL filtering slowly climb, as the new sending IP addresses and click-me links were added to the database.

The campaign appeas to have continued past the fourth week. The phrase and pattern filters were back to normal levels, with the IP and URL filters doing most of the work, indicating we had successfully adapted to the new campaign while blocking it.


The data indicates that December saw a large mutating spam campaign during the end of the month. SpamStopsHere and our live threat review team kept right up with it through phrase and pattern filtering, until new IP adddresses and URLs were added to the database.

Thank you for reading the Global Spam Reports. We look forward to providing you with information in the months to come with our continuing coverage of global spam threats. To receive updates on the Global Spam Report automatically, click here to add our monthly reports on global spam threats to your RSS feed.

Try SpamStopsHere for Free!

Try SpamStopsHere FREE for 30 days or call us anytime at 734-426-7500 (Global) or 800-458-3348 (US/Canada). We're always here. 24/7/365.