An empirical exploration of whether spammers take Christmas off

December 29, 2011

There's a vague mythology that spammers take holidays off, or at least some spammers do. I decided I was curious enough to see if this was true, at least as far as our own data goes, so I looked at our filtering systems's statistics. This actually gets into interesting issues, because Christmas fell on a weekend this year plus you'd expect some degree of day to day fluctuation.

(For bonus complication, a month ago includes American Thanksgiving, which spammers might also partially take off.)

The short answer is that spammers do not appear to take Christmas off, although they may take weekends off. Neither the 24th nor the 25th had the lowest spam levels for Saturdays and Sundays since November 20th, although both had relatively low levels.

  • Saturdays: 6770, 7680, 6210, 7110, and 6640 spam messages.
  • Sundays: 5810, 6300, 5970, 6680, 7400, and 5990 spam messages.

Weekends are slower than weekdays in general; weekdays average 7910 spam messages per day while weekends average 6600 per day (Saturday's average is higher than Sunday's by 500 messages or so, at least over my sample range).

I admit that I'm surprised by this result, especially the difference from the short term versus the long term perspective. If I had just looked back at the previous week I would have confidently said that spammers took the Christmas weekend off, but looking back further strongly suggests that it's just regular fluctuation.

All sorts of cautions apply here. Our numbers are small and thus potentially noisy. In addition, spam volume changes over time so going back too far has dangers and it's going to be hard to tell fluctuations in weekday to weekday volume from overall volume changes. There are probably statistical techniques to get useful information despite all of this, but I don't know of them (I don't even know enough gnuplot to throw the raw data into a plot to see if any patterns jump out).

(Gnuplot is one of those things that I really should learn sometime but I keep never getting to it.)

Written on 29 December 2011.
« Blog entries should have visible dates (usually)
Why I don't like Python 3 dropping the comparison function for sorting »

Page tools: View Source, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Thu Dec 29 01:14:03 2011
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.