Time Email Received Helps to Identify Spam - More Spam Received at Night   - 1,238 Views,

Now, again, this applies to email received during U.S. nighttime hours - which doesn’t mean that it wasn’t sent during the day from somewhere else. For example, it may be the morning in Korea when some spammer there hits “send”, but in the U.S. where it’s received, it’s the middle of the night.

Hughes writes, of using “time received” as a test for whether something is more likely or not to be spam, that he is now “fully convinced that this must be a useful test.”

The way that he arrived at this conclusion was by plotting all of the email that he received over a year. He noted that there were regular spikes in traffic during weekdays, as one might expect for legitimate email. But, he discovered, there were no swings or spikes in the amount of bad email (spam, phishing, viruses, etc. - what Hughes calls “malmail”). Which meant that the ratio of good:bad email changed with the time and day of the week. At night, and on weekends, there was a higher malmail:good mail ratio.

Says Hughes, “Therefore, the ratio of malmail to real mail clearly is affected by time of day/day of week. If mail arrives outside of ‘normal email’ hours, it surely is much more likely to be malmail; a rule which learns which days/hours are good vs bad and scores mail accordingly surely would be useful for identifying and filtering out malmail.”

This makes a lot of sense, and we look forward to spam filters, like Spam Assassin, incorporating a “time of day” received rule into their rule set, as Hughes suggests.

You can read Hughes full analysis, and view his charts, here.