Craig Hughes, who originally worked with the Spam Assassin team, and then went on to found GumStix, has discovered something interesting: much more spam is received during the nighttime hours than during the day. It’s a dramatic enough difference that Hughes says that he is convinced that ‘time of day received’ is a useful test to help determine whether something is spam.
Now, again, this applies to email received during U.S. nighttime hours – which doesn’t mean that it wasn’t sent during the day from somewhere else. For example, it may be the morning in Korea when some spammer there hits “send”, but in the U.S. where it’s received, it’s the middle of the night.
Hughes writes, of using “time received” as a test for whether something is more likely or not to be spam, that he is now “fully convinced that this must be a useful test.”
|Get notified of new Internet Patrol articles for free!
|Or Read Internet Patrol Articles Right in Your Inbox!
as Soon as They are Published! Only $1 a Month!
Imagine being able to read full articles right in your email, or on your phone, without ever having to click through to the website unless you want to! Just $1 a month and you can cancel at any time!
The way that he arrived at this conclusion was by plotting all of the email that he received over a year. He noted that there were regular spikes in traffic during weekdays, as one might expect for legitimate email. But, he discovered, there were no swings or spikes in the amount of bad email (spam, phishing, viruses, etc. – what Hughes calls “malmail”). Which meant that the ratio of good:bad email changed with the time and day of the week. At night, and on weekends, there was a higher malmail:good mail ratio.
Says Hughes, “Therefore, the ratio of malmail to real mail clearly is affected by time of day/day of week. If mail arrives outside of ‘normal email’ hours, it surely is much more likely to be malmail; a rule which learns which days/hours are good vs bad and scores mail accordingly surely would be useful for identifying and filtering out malmail.”
This makes a lot of sense, and we look forward to spam filters, like Spam Assassin, incorporating a “time of day” received rule into their rule set, as Hughes suggests.
You can read Hughes full analysis, and view his charts, here.
No Paywall Here!
The Internet Patrol is and always has been free. We don't hide our articles behind a paywall, or restrict the number of articles you can read in a month if you don't give us money. That said, it does cost us money to run the site, so if something you read here was helpful or useful, won't you consider donating something to help keep the Internet Patrol free? Thank you!
|Get notified of new Internet Patrol articles!