<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Observations from Uppsala &#187; spam</title>
	<atom:link href="http://jakob.engbloms.se/archives/tag/spam/feed" rel="self" type="application/rss+xml" />
	<link>http://jakob.engbloms.se</link>
	<description>Computer Technology: Simulation, Virtualization, Virtual Platforms, Embedded, Multicore and Multiprocessing (by Jakob Engblom)</description>
	<lastBuildDate>Sun, 29 Jan 2012 19:45:28 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
<image>
    <title>Observations from Uppsala</title>
    <url>http://jakob.engbloms.se/favicon.png</url>
    <link>http://jakob.engbloms.se</link>
    <width>32</width>
    <height>32</height>
    <description>Observations from Uppsala - http://jakob.engbloms.se</description>
    </image>		<item>
		<title>500K Spam</title>
		<link>http://jakob.engbloms.se/archives/1076?&#038;owa_medium=feed&#038;owa_sid=</link>
		<comments>http://jakob.engbloms.se/archives/1076#comments</comments>
		<pubDate>Wed, 03 Feb 2010 20:11:39 +0000</pubDate>
		<dc:creator>Jakob</dc:creator>
				<category><![CDATA[security]]></category>
		<category><![CDATA[spam]]></category>

		<guid isPermaLink="false">http://jakob.engbloms.se/?p=1076</guid>
		<description><![CDATA[We recently had a malfunction in our spam filters at work, so I had to go back and review the catch for possible false positives. I sort things into two bins using spamassassin, one for most likely spam, and one for probable spam.  When things started to go bad, the most likely folder had reached [...]]]></description>
			<content:encoded><![CDATA[<p>We recently had a malfunction in our spam filters at work, so I had to go back and review the catch for possible false positives. I sort things into two bins using spamassassin, one for most likely spam, and one for probable spam.  When things started to go bad, the most likely folder had reached more than 2 GB, and the probable some 500 MB.</p>
<p><span id="more-1076"></span>As you can see from the webmail screenshot below, the probable folder contained almost 100 thousand spam email. These were collected since May of 2008, or in a space of roughly 21 months.</p>
<p><img class="aligncenter size-full wp-image-1077" title="spamassassin 98322 messages caught" src="http://jakob.engbloms.se/wp-content/uploads/2010/02/spamassassin-98322-messages-caught.png" alt="spamassassin 98322 messages caught" width="715" height="400" /></p>
<p>If I guesstimate that the other folder has about the same average size, that adds in another 400 thousand spam. Bringing the total caught by these filters to about half a million overall. If you divide it down to days, it is &#8220;only&#8221; about 630 per day, plus some more that secondary spam filters catch, plus the ones that get through and I manually have to delete. But these other ones won&#8217;t add up to much more than a few tens of thousands in the same time spa<del datetime="2010-02-03T20:02:13+00:00">m</del>n.</p>
<p>It is amazing just how voluminous this infestation is&#8230;</p>
<p>Legit business emails can&#8217;t be much more than fifty per day, plus various general mailing lists. Still, that means that probably no more than 75% of all email I receive is spam. Maybe I should consider myself lucky, I have seen analysis talking about 99% of all email on the Internet being spam&#8230;</p>
<p>Interesting it was.</p>
<div class="simple_likebuttons_container_small">
      <div class="simple_likebuttons_googleplus">
        <g:plusone size="medium" count="false" href="http://jakob.engbloms.se/archives/1076"></g:plusone>
      </div>
    
      <div class="simple_likebuttons_twitter simple_likebuttons_twitter_s">
        <a href="https://twitter.com/share" class="twitter-share-button" data-count="none" data-url="http://jakob.engbloms.se/archives/1076" data-lang="en">Tweet</a>
      </div>
    
      <div class="simple_likebuttons_facebook">
        <div id="fb-root"></div>
        <script>(function(d, s, id) {
          var js, fjs = d.getElementsByTagName(s)[0];
          if (d.getElementById(id)) {return;}
          js = d.createElement(s); js.id = id;
          js.src = "//connect.facebook.net/en_US/all.js#xfbml=1";
          fjs.parentNode.insertBefore(js, fjs);
        }(document, "script", "facebook-jssdk"));</script>
        <div class="fb-like" data-href="http://jakob.engbloms.se/archives/1076" data-send="false" data-layout="button_count" data-show-faces="false" data-width="90"></div>
      </div>
    </div>]]></content:encoded>
			<wfw:commentRss>http://jakob.engbloms.se/archives/1076/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Off-topic: Crime Medicine</title>
		<link>http://jakob.engbloms.se/archives/327?&#038;owa_medium=feed&#038;owa_sid=</link>
		<comments>http://jakob.engbloms.se/archives/327#comments</comments>
		<pubDate>Sat, 01 Nov 2008 13:21:17 +0000</pubDate>
		<dc:creator>Jakob</dc:creator>
				<category><![CDATA[business issues]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[websites]]></category>
		<category><![CDATA[fraud]]></category>
		<category><![CDATA[medicine]]></category>
		<category><![CDATA[spam]]></category>

		<guid isPermaLink="false">http://jakob.engbloms.se/?p=327</guid>
		<description><![CDATA[The Swedish national medical products agency is running a very cleverly marketed campaign right now to inform people about the perils of buying medicine over the Internet. They are running fake advertisement spots on television, mimicking the typical medical adverts found in the US (and the few other countries where such advertising is allowed for [...]]]></description>
			<content:encoded><![CDATA[<p>The Swedish national medical products agency is running a very cleverly marketed campaign right now to inform people about the perils of buying medicine over the Internet. They are running fake advertisement spots on television, mimicking the typical medical adverts found in the US (and the few other countries where such advertising is allowed for prescription medicine), with a trustworthy doctor talking about the benefits of this and that&#8230; and slowly going into weird land about how the products might not be want you think and maybe don&#8217;t contain the right stuff, etc.Finally, you are pointed to <a href="http://www.crimemedicine.com/">www.crimemedicine.com</a>, a site setup for this campaign. All very clever. In fact, so clever that some people reported the spots to the consumer watchdog as being illegal advertisements&#8230; brilliant!</p>
<p><span id="more-327"></span></p>
<p>It is mostly in Swedish, though, but they have some English-language information at <a href="http://www.crimemedicine.com/lib/html/english.html">http://www.crimemedicine.com/lib/html/english.html</a>.</p>
<p>I think this is pretty important stuff, way too many people are buying counterfeit and illegal and usually dangerous medical stuff over the Internet. That is not how you deal with your health: if you have a problem, go to a doctor or at least a physical pharmacy and talk to someone with proper credentials. Never ever self-medicate with stuff you find of the net. Or even sometimes buy in physical pharmacy in less well-policied countries. Real medications can be expensive &#8212; but most of the time, you are getting what you pay for. As always.</p>
<div class="simple_likebuttons_container_small">
      <div class="simple_likebuttons_googleplus">
        <g:plusone size="medium" count="false" href="http://jakob.engbloms.se/archives/327"></g:plusone>
      </div>
    
      <div class="simple_likebuttons_twitter simple_likebuttons_twitter_s">
        <a href="https://twitter.com/share" class="twitter-share-button" data-count="none" data-url="http://jakob.engbloms.se/archives/327" data-lang="en">Tweet</a>
      </div>
    
      <div class="simple_likebuttons_facebook">
        <div id="fb-root"></div>
        <script>(function(d, s, id) {
          var js, fjs = d.getElementsByTagName(s)[0];
          if (d.getElementById(id)) {return;}
          js = d.createElement(s); js.id = id;
          js.src = "//connect.facebook.net/en_US/all.js#xfbml=1";
          fjs.parentNode.insertBefore(js, fjs);
        }(document, "script", "facebook-jssdk"));</script>
        <div class="fb-like" data-href="http://jakob.engbloms.se/archives/327" data-send="false" data-layout="button_count" data-show-faces="false" data-width="90"></div>
      </div>
    </div>]]></content:encoded>
			<wfw:commentRss>http://jakob.engbloms.se/archives/327/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Off-Topic: Blog Spam Statistics</title>
		<link>http://jakob.engbloms.se/archives/72?&#038;owa_medium=feed&#038;owa_sid=</link>
		<comments>http://jakob.engbloms.se/archives/72#comments</comments>
		<pubDate>Sun, 03 Feb 2008 21:36:01 +0000</pubDate>
		<dc:creator>Jakob</dc:creator>
				<category><![CDATA[blogging]]></category>
		<category><![CDATA[spam]]></category>

		<guid isPermaLink="false">http://jakob.engbloms.se/archives/72</guid>
		<description><![CDATA[Seems like my blog has been picked up by some spamming machine &#8212; at least I hope it is a machine, what a waste of manpower to manually send in spam since I am filtering all comments and not letting anything remotely spam-like through. Anyway, it is kind of interesting to see what kinds of [...]]]></description>
			<content:encoded><![CDATA[<p>Seems like my blog has been picked up by some spamming machine &#8212; at least I hope it is a machine, what a waste of manpower to manually send in spam since I am filtering all comments and not letting anything remotely spam-like through. Anyway, it is kind of interesting to see what kinds of things are being pushed using blog spam. Read on for more, but suffice to say that porn is dominant&#8230;<span id="more-72"></span>Here is a simple diagram. Precise numbers are not really interesting, it is more the big picture that I wanted to analyze.</p>
<p><img src="http://jakob.engbloms.se/wp-content/uploads/2008/02/porn-categories.png" alt="Blog spam categories" align="left" /></p>
<p>Comments:</p>
<ul>
<li>Most spam is for porn sites of various kinds. Strange that they need to advertise themselves, but I guess they could be temporary sites set up to spread various forms of browser-attacking malware.</li>
<li>Replica handbags and watches come in second, clear market for scams and making money there.</li>
<li>Viagra and tramadol-style substances are also very lucrative, especially for expensive fakes. I can see the logic.</li>
<li>There is also a fair number of posts that I cannot make sense of immediately. Possibly, they are attempts at boosting search-engine ratings of the sites submitted as URLs to the posts&#8230; but since all comment links are set to &#8220;no follow&#8221; on this blog, that effort is wasted.</li>
<li>Various financial services, especially payday loans, are the last large category.</li>
<li>There are some interesting spams that just contain jumbles of letters (consonants only), and a link to a similar-looking URL. No idea why someone would do that, as nobody is likely to follow a meaningless link.</li>
</ul>
<p>Overall, this follows the logic of spam of being pretty lucrative, especially selling various forms of overpriced fakes or replicas to people who seem unable to tell that a deal that is too good to be true really is.</p>
<div class="simple_likebuttons_container_small">
      <div class="simple_likebuttons_googleplus">
        <g:plusone size="medium" count="false" href="http://jakob.engbloms.se/archives/72"></g:plusone>
      </div>
    
      <div class="simple_likebuttons_twitter simple_likebuttons_twitter_s">
        <a href="https://twitter.com/share" class="twitter-share-button" data-count="none" data-url="http://jakob.engbloms.se/archives/72" data-lang="en">Tweet</a>
      </div>
    
      <div class="simple_likebuttons_facebook">
        <div id="fb-root"></div>
        <script>(function(d, s, id) {
          var js, fjs = d.getElementsByTagName(s)[0];
          if (d.getElementById(id)) {return;}
          js = d.createElement(s); js.id = id;
          js.src = "//connect.facebook.net/en_US/all.js#xfbml=1";
          fjs.parentNode.insertBefore(js, fjs);
        }(document, "script", "facebook-jssdk"));</script>
        <div class="fb-like" data-href="http://jakob.engbloms.se/archives/72" data-send="false" data-layout="button_count" data-show-faces="false" data-width="90"></div>
      </div>
    </div>]]></content:encoded>
			<wfw:commentRss>http://jakob.engbloms.se/archives/72/feed</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>BBC Documentary: On the Trail of Spammers</title>
		<link>http://jakob.engbloms.se/archives/69?&#038;owa_medium=feed&#038;owa_sid=</link>
		<comments>http://jakob.engbloms.se/archives/69#comments</comments>
		<pubDate>Sun, 20 Jan 2008 21:00:50 +0000</pubDate>
		<dc:creator>Jakob</dc:creator>
				<category><![CDATA[business issues]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[podcast commentary]]></category>
		<category><![CDATA[spam]]></category>

		<guid isPermaLink="false">http://jakob.engbloms.se/archives/69</guid>
		<description><![CDATA[If you are looking for a good popular introduction to what spam is and how it works, the BBC World Service Documentary Podcast has a very good documentary up right now. I cannot find a direct link, but go to the overview page and then download &#8220;Doc: Assignment &#8211; On the trail of spammers 17 [...]]]></description>
			<content:encoded><![CDATA[<p><img src="http://www.bbc.co.uk/radio/podcasts/docarchive/assets/_170x170.jpg" align="left" height="100" hspace="10" width="100" />If you are looking for a good popular introduction to what spam is and how it works, the <a href="http://www.bbc.co.uk/radio/podcasts/docarchive/">BBC World Service Documentary Podcas</a>t has a very good documentary up right now. I cannot find a direct link, but go to the overview page and then download &#8220;Doc: Assignment &#8211; On the trail of spammers 17 Jan 2007&#8243;. Enjoy!</p>
<div class="simple_likebuttons_container_small">
      <div class="simple_likebuttons_googleplus">
        <g:plusone size="medium" count="false" href="http://jakob.engbloms.se/archives/69"></g:plusone>
      </div>
    
      <div class="simple_likebuttons_twitter simple_likebuttons_twitter_s">
        <a href="https://twitter.com/share" class="twitter-share-button" data-count="none" data-url="http://jakob.engbloms.se/archives/69" data-lang="en">Tweet</a>
      </div>
    
      <div class="simple_likebuttons_facebook">
        <div id="fb-root"></div>
        <script>(function(d, s, id) {
          var js, fjs = d.getElementsByTagName(s)[0];
          if (d.getElementById(id)) {return;}
          js = d.createElement(s); js.id = id;
          js.src = "//connect.facebook.net/en_US/all.js#xfbml=1";
          fjs.parentNode.insertBefore(js, fjs);
        }(document, "script", "facebook-jssdk"));</script>
        <div class="fb-like" data-href="http://jakob.engbloms.se/archives/69" data-send="false" data-layout="button_count" data-show-faces="false" data-width="90"></div>
      </div>
    </div>]]></content:encoded>
			<wfw:commentRss>http://jakob.engbloms.se/archives/69/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

