Spam report: February 2007

Spam in mail traffic

In February the volume of spam coincided with the predictions of Kaspersky Lab analysts. Spam made up 70 – 80% of all mail traffic, which means that just like last year, 7-8 out of every 10 emails are spam.

Spam reached a high of 86.8% of all email on February 11^th, while a monthly low of 69.8% was recorded on February 7^th.

Spam volume: February 2007

Spam categories

There were no major changes in the top spam categories in February, although some of the categories did swap places:

• Education – 16.2% (ranked 3^rd in January).
• Medicines, health products and services – 13.9% (ranked 2^nd in January).
• Personal finance – 13.3% (1^st place in January).
• Computers and the Internet – 9.2% (5^th place in January).
• Electronic advertising services – 8.9% (tied at 2^nd place in January).

Distribution of Russian Internet spam by topic: February 2007

Compared to January 2007, the education category has increased one and a half times. Spammers are looking for new clients. The most popular topics for training courses and seminars are: annual accounting reports, tax reports, tax audits and other topics relating to annual company and organization financial reports.

The computer fraud category decreased nearly twice. Apparently fraudulent spammers have harvest their ill-gotten gains from the most recent batch of unwitting users and are taking a short break.

Holiday spam

There was another set of public holidays in February, and spammers see St. Valentine’s Day and Day of the Defenders of the Fatherland (23^rd February) as an advertising opportunity. After that, International Women’s Day (8^th March) is right around the corner.

A cycle of holiday advertising has taken shape in the spam community. This is not the first year that spammers have advertised crossbows and night-vision sights as presents for men, and bedlinen and flowers for women. According to spammers, gifts that you might buy on TV shopping channels or from an infomercial are appropriate for both men and women: waterproof shower radios, amulets, and other trinkets.

Stars for sale

Throughout February, spammers repeatedly advertised popular Russian celebrities from variety shows and the theater. The volume and variety of these advertisements is surprising. Hundreds of thousands of Russian Internet users received numerous emails with attention-grabbing subjects like “Celebrity Price List,” “Lenkom Stars,” and some more modest ones such as “Tour Schedule” or “Artists’ rates.” Below is an excerpt from one such message:

It’s not clear how many users have tried to commission popular artists via these mass mailings, or who comes to perform for them (if they come at all).

Tricks of the trade

In February spam with graphical attachments amounted to 27.2% of all spam, which is slightly less than in January. It is still too early to say whether or not there will be a downward trend in March.

Spammers have unexpectedly tried to resurrect the use of animated graphics, which were more or less abandoned in late November 2006. The new variety of animated spam is different in that the picture is broken into fragments, and each fragment is rotated at a different angle.

A few examples of frames of animated spam are shown below:

The combination of the above frames looks something like this:

Just like many previous attempts to use different kinds of graphical technology, this approach will probably not be overly successful or help spam evade spam filters. Instead, it will probably simply serve as an experiment that will not last for long. The problem is that when using this and similar tactics, the advertisements become practically unreadable. As a result, the spammer gains nothing from the mailing. This kind of situation in the spammer business won’t last long, so antispam developers need to get ready for whatever the spammers’ next move might be.

Monthly summary

• Spam still accounts for 70 – 80% of all mail traffic on the Russian Internet.

• Graphical spam is holding its ground and comprised 27.4% of all spam in February.
• February saw spammers making a second attempt at using animated spam, this time with image fragments being rotated.