Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Mailbag: Readers' thoughts on how some spammers bypass spam filters

Are spammers smarter than spam filters?
Unified Communications Alert By Michael Osterman , Network World , 05/11/2006
Michael Osterman
Sign up for this newsletter now!

Unified messaging and communications analysis by consultant Michael Osterman.

  • Share/Email
  • Tweet This
  • Comment
  • Print

My recent article on how some spammers can bypass spam filtering technologies generated a significant response. Here are some highlights of the comments I received:

* "I have observed exactly what you wrote about with regard to subject lines. Most spammers are dumb as rocks when it comes to subject line content. But, they will always be smarter than any spam filters, because they are very good at learning how the newer filters (and enhancements to older filters) identify their refuse for what it is."

* "The current favorite is the pump-and-dump stock scams that come in on a single embedded image. The subject has a few random words and there's very little to the HTML source in the message to tip off spam filters. We have one of the best anti-spam solutions in the world, using a combination of reputation filtering, Bayesian, and pattern/hash matching, and we're not blocking these new types of spam yet."

* "I hate the spam I get that has a 're: some topic' subject line. Always have to read the subject line closely or open it to determine if it is legitimate or not. It almost never is. It's the 'almost' that is painful."

* "Spammers are not trying to display their humanity or IQ by bypassing your filter with various ploys, but it strikes me also as nonsensical that once a spammer tricks somebody into opening and reading his garbage, he fails just as miserably to make the cut when he gets a real audition."

* "Over the past several months I have seen more and more spam utilizing valid subject lines with embedded GIFs or JPEGs that advertise what they are peddling. It is very difficult for spam filters to detect and stop this type of messaging unless its source is an open relay, dynamically assigned IP address or known blacklisted IP address."

Thank you to everyone who provided their comments on the article.

Michael Osterman is principal analyst of Osterman Research.

  • Share/Email
  • Tweet This
  • Comment
  • Print
Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed