The Spam Omelette

We analyzed a significant
amount of spam messages in order to create a visual map with the most
frequently used words in spam messages. This map is intended to provide visual
cues for undesrstanding what are the new trends in spam messages, while
providing significant insight to researchers on the current spam campaigns.

Testing methodology

 To create the map, we analyzed
approximately 7 million spam messages collected through BitDefender’s worldwide
network of honeypots (A honeypot is an e-mail address that is only used to
collect spam. It acts as if it was used by a human operator and is usually
publicly displayed on discussion groups and forums.). The large number of
analyzed messages and the global distribution of honeypots are guarantees of a
reliable result.

The entire spam stock has been
automatically parsed for words. Some commonly used words have been eliminated,
since they have no relevance – our goal is to get a top of the “real” words,
not to count how many times “a”, “and” or “the” occur in these messages.

Given the enormous amount of spam
messages processed, the  dataset is quite
large, which somewhat hinders a deep analysis. We ran a “normalization” script
that simplifies the number of occurrences of a word. The procedure focuses
mostly on the proportion of words, rather than on the exact number of
occurrences. For instance, the word “offer” occurs in 20 percent of the
analyzed spam messages, while the word “free” only occurs in 15 percent of the
e-mails.

The spam map was created using Wordle, a public
word cloud generator developed by Jonathan Feinberg for IBM.

The resulting spam map offers visual clues about the trends in the spam
industry. The visual approach is more eloquent than simple word statistics, as
it provides significant details about spammers’ focus shift at a single glance.

The Top 5 Results

1. An OFFER you can not refuse

This week’s champion in spam messages is the word “offer”. Each spam
message offers something: better sexual performance through prescription drugs,
cheaper OEM software or fashionable accessories – everything at a discounted
price.

Moreover,
the Canadian Pharmacy spam message come disguised as legitimate news flashes
sent by sites such as CNN, NBC and CBS. Users are even provided with a forged
link to unsubscribe, but clicking on it would only confirm the spammer that the
address is in use and operated by a human user.

 

 

5. CHECK this out to get infected

Most
spam messeges advise receivers to