Wandering Thoughts archives

An empirical exploration of whether spammers take Christmas off

There's a vague mythology that spammers take holidays off, or at least some spammers do. I decided I was curious enough to see if this was true, at least as far as our own data goes, so I looked at our filtering systems's statistics. This actually gets into interesting issues, because Christmas fell on a weekend this year plus you'd expect some degree of day to day fluctuation.

(For bonus complication, a month ago includes American Thanksgiving, which spammers might also partially take off.)

The short answer is that spammers do not appear to take Christmas off, although they may take weekends off. Neither the 24th nor the 25th had the lowest spam levels for Saturdays and Sundays since November 20th, although both had relatively low levels.

• Saturdays: 6770, 7680, 6210, 7110, and 6640 spam messages.
• Sundays: 5810, 6300, 5970, 6680, 7400, and 5990 spam messages.

Weekends are slower than weekdays in general; weekdays average 7910 spam messages per day while weekends average 6600 per day (Saturday's average is higher than Sunday's by 500 messages or so, at least over my sample range).

I admit that I'm surprised by this result, especially the difference from the short term versus the long term perspective. If I had just looked back at the previous week I would have confidently said that spammers took the Christmas weekend off, but looking back further strongly suggests that it's just regular fluctuation.

All sorts of cautions apply here. Our numbers are small and thus potentially noisy. In addition, spam volume changes over time so going back too far has dangers and it's going to be hard to tell fluctuations in weekday to weekday volume from overall volume changes. There are probably statistical techniques to get useful information despite all of this, but I don't know of them (I don't even know enough gnuplot to throw the raw data into a plot to see if any patterns jump out).

(Gnuplot is one of those things that I really should learn sometime but I keep never getting to it.)

An advance fee fraud spam aphorism

Here's an aphorism:

Any tragedy or political turmoil will be immediately seized on by advance fee fraud spammers as part of their come-on messages.

Be it the invasion of Iraq, a tragic tsunami, a big airplane crash, or the overthrow of the despotic Libyan government, you can be confident that soon your email will have messages from, say, the relative of a former regime member who needs your help to get some money out of the country.

This is a fine aphorism except that once I started actually looking at it, it looked less and less true. While it's true that this sort of thing happens quite often in reaction to world events, not any old tragedy and turmoil will do. For example, take Japan's Sendai quake and the subsequent Fukushima nuclear events. Under normal circumstances, this would be advance fee fraud gold; you could use it to spin all sorts of tragic tales to hook in marks. But I don't think I've seen a single English language spam that talks about it. My guess as to what makes the Japanese tragedy bad for advance fee fraud spammer is pretty simple: Japan is a prosperous first world country. It's pretty implausible that a person in Japan would need to reach out to someone outside their country for help, implausible enough to make potential suckers wake up and realize something's wrong.

Another recent tragedy that I haven't seen show up in advance fee fraud spam (at least not yet) is the flooding in Thailand. My theory here is that these floods are not big and well enough known to make good advance fee fraud bait. If your targets have never heard of the tragedy you're trying to exploit, it's not really helping to engage their sympathies and their belief.

So for the purposes of the aphorism, it's more that any sufficiently large third world tragedy or turmoil will be seized on for advance fee fraud come-ons. But, as usual, that makes the aphorism less sharp.

(On that note, I wonder if we're about to get a rush of North Korean related advance fee fraud spam in the wake of Kim Jong-il's death.)