Time Email Received Helps to Identify Spam – More Spam Received at Night
0 (0)

The Internet Patrol - Patrolling the Internet for You
Rate this post!
 

Craig Hughes, who originally worked with the Spam Assassin team, and then went on to found GumStix, has discovered something interesting: much more spam is received during the nighttime hours than during the day. It’s a dramatic enough difference that Hughes says that he is convinced that ‘time of day received’ is a useful test to help determine whether something is spam.

Now, again, this applies to email received during U.S. nighttime hours – which doesn’t mean that it wasn’t sent during the day from somewhere else. For example, it may be the morning in Korea when some spammer there hits “send”, but in the U.S. where it’s received, it’s the middle of the night.


Hughes writes, of using “time received” as a test for whether something is more likely or not to be spam, that he is now “fully convinced that this must be a useful test.”

The way that he arrived at this conclusion was by plotting all of the email that he received over a year. He noted that there were regular spikes in traffic during weekdays, as one might expect for legitimate email. But, he discovered, there were no swings or spikes in the amount of bad email (spam, phishing, viruses, etc. – what Hughes calls “malmail”). Which meant that the ratio of good:bad email changed with the time and day of the week. At night, and on weekends, there was a higher malmail:good mail ratio.

Says Hughes, “Therefore, the ratio of malmail to real mail clearly is affected by time of day/day of week. If mail arrives outside of ‘normal email’ hours, it surely is much more likely to be malmail; a rule which learns which days/hours are good vs bad and scores mail accordingly surely would be useful for identifying and filtering out malmail.”

No Paywall Here!
The Internet Patrol is and always has been free. We don't hide our articles behind a paywall, or restrict the number of articles you can read in a month if you don't give us money. That said, it does cost us money to run the site, so if something you read here was helpful or useful, won't you consider donating something to help keep the Internet Patrol free?
Click for amount options
Other Amount:
What info did you find here today?:

 

This makes a lot of sense, and we look forward to spam filters, like Spam Assassin, incorporating a “time of day” received rule into their rule set, as Hughes suggests.

You can read Hughes full analysis, and view his charts, here.

No Paywall Here!
The Internet Patrol is and always has been free. We don't hide our articles behind a paywall, or restrict the number of articles you can read in a month if you don't give us money. That said, it does cost us money to run the site, so if something you read here was helpful or useful, won't you consider donating something to help keep the Internet Patrol free?
Click for amount options
Other Amount:
What info did you find here today?:

Rate this post!
 

Leave a Reply

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.