Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Spam

Does SPAM Peak on Wednesday? 54

Posted by Cliff from the imagine-that dept.
danlor asks: "After installing a pretty good spam filter here at work, we noticed an interesting weekly trend in overall spam intercepts. They peak on Wednesday and trough o n Sunday. It is an almost perfect bell curve. We have gone over this quite a few times here, but cannot come to consensus on why this would be. Could Spammers really be God fearing? Why would Spammers have a 'hump' day?" Has anyone else noticed this trend?
This discussion has been archived. No new comments can be posted.

Does SPAM Peak on Wednesday? More

Does SPAM Peak on Wednesday?

Comments Filter:

  • Graphs? (Score:3, Interesting)

    by Vaevictis666 ( 680137 ) on Tuesday September 16, 2003 @08:11PM (#6981083)
    Got any graphs or anything compiled from your findings?

  • Maybe they send from work or school? (Score:3, Insightful)

    by narratorDan ( 137402 ) <narratordan@gmail.com> on Tuesday September 16, 2003 @08:14PM (#6981117)
    That would account for the wednesday peek and sunday valley. Or during the week is when there is the most net traffic in general and this helps to cover up their activities. Allows them to become "lost" in the sea of data.

    NarratorDan

    • Re:Maybe they send from work or school? (Score:4, Interesting)

      by GigsVT ( 208848 ) on Tuesday September 16, 2003 @08:16PM (#6981132) Journal
      Or maybe they do things on the weekend, like normal people? And don't feel like getting much work done on Monday, like normal people?

      I bet if you graphed legitimate business email, it would show the exact same trends.

      Spammers are people too, just barely. :)
      • Actually I went through the process of graphing our email usage earlier this year. We really only saw that Sunday was less than Saturday which was less than the weekdays. Monday to Friday were almost dead level. This is all external email for a very large international business.

        This took into account both the number of emails and the total size.
      • I doubt that has any relationship to spam patterns. Do you really think spams are written and sent by hand? I think it is more likely that they are generated en masse by scripts. CPUs don't really care what day it is.

  • Different Days (Score:3, Funny)

    by K_J_Raine ( 622906 ) on Tuesday September 16, 2003 @08:14PM (#6981123)
    On my company's server we noticed two days that seemed to stand out in regards to spam - Wednesday and Saturday. The rest of the week seems to be rather flat - one or two spam emails.

    Of course getting inside the mind of a spammer would be something that would require danger pay.

    Hmm... all these people really need to know about herbal vigara... and I'll be the one to sell it to them!!

  • People Effect (Score:3, Insightful)

    by Stone Rhino ( 532581 ) <mparke@gm a i l.com> on Tuesday September 16, 2003 @08:17PM (#6981144) Homepage Journal
    I didn't see a clear explanation of your product's methods for spam filtering, but if it's anything like other products that judge email to be spam based on the votes of the users who see it, it could simply be a matter of workers blocking mail on monday, that other workers block on tuesday, that builds to a crest on wednesday and then falls off because in the end of the week, you have already recieved the emails that were judged to be bad on monday (but were still coming). Acutally, this sounds stupid now that I mention it, but there could be a similar building effect. With all the relays that spam bounces through, it's possible that you could be recieving messages late, and as spammers take a weekend off, your messages drop off dramatically. Just a thought.
  • Companies request spam sendouts on Monday, tuesday is the build & send, wednesday is the peak filter day?

  • Not for me (Score:5, Interesting)

    by SeanAhern ( 25764 ) on Tuesday September 16, 2003 @08:31PM (#6981270) Journal
    While I don't have the statistics of a multi-user mail server, I do have statistics for myself.

    Analyzing 11,560 spam emails that have come to my inbox over the last few years, here is the distribution over the days of the week:

    . . . .percent. . . . .1
    . . . . . . . . . .8 9 0
    . . 0 . . . . . . .0 0 0
    Mon xxxxxxxxxxxxxxxx | |
    Tue xxxxxxxxxxxxxxxxxx |
    Wed xxxxxxxxxxxxxxxxxxxx
    Thu xxxxxxxxxxxxxxxxxx |
    Fri xxxxxxxxxxxxxxxxxx |
    Sat xxxxxxxxxxxxxxxxxx |
    Sun xxxxxxxxxxxxxxxx | |
    (What a pain it is to get a graph to reproduce correctly on slashdot!)

    While it does show a "bell" with a peak on Wednesday and a dip on Sunday and Monday, it's certainly not significant. 20% less email on the lowest vs. the highest day isn't significant in my mind.

    (Statistics generated with MailListStat [freshmeat.net] from freshmeat [freshmeat.net].
    • Question: I wonder if a potential trend towards wednesdays is more prounounced or less pronounced than it was months or years ago. Considering you've received 11,560 spam message, I have to wonder if that includes a very long period of time, or you are an exception in the volume of spam you receive. (And/or things like virus mailings or anything else is counted in.)
      • I haven't get a lot of virus mailings in the last couple waves. So, while they might be included in the count (I didn't look), they won't significantly change the results.

        I just looked at the dates. Spammers lie on the "Date" header, so I looked at the dates in the "Received" lines. These 11,560 spams were received between 15 Jan 2003 and 15 Sep 2003 for a rough average of 40 spam messages a day.
    • You should immediately file a bug report for MailListStat.

      If I sum up the values of Mon..Sun then I see that you get 620% of spam every week. That's of course quite a lot of spam.

      • Consider the statistics differently. The percentages are not percentages of all mail, but percentages of the maximum received in any one day. If the most mail is received on Wednesday, it's at the maximum per day. Mondays are 80% of the maximum per day.

        One might argue that having the percentages be in relation to all spam received. But I think it's more useful to have it be on a daily basis, as that's what's being reported for that particular graph.

    • While it does show a "bell" with a peak on Wednesday and a dip on Sunday and Monday, it's certainly not significant. 20% less email on the lowest vs. the highest day isn't significant in my mind.

      But it is significant. With about 1,651 emails per day of the week (11,560/7=1,651), the 1-sigma variation due to random chance is sqrt(1651)/1651 = 2.5%, assuming that the spams are independent of each other (Poisson statistics).

      Your detection of a ~20% variation allows you to quite strongly rule out the nul

  • Waiting for inbox clean-up (Score:3, Interesting)

    by romcabrera ( 699616 ) on Tuesday September 16, 2003 @08:38PM (#6981314) Homepage
    Many people don't read their emails the weekend (workers, students, etc.). So, it's typical that a monday morning in-box is always almost full.

    Many people I know, keep cleaning their inbox until tuesday indeed! So, Wednesday might be a safe day for spamming, as inboxes are emptier.

  • Because more people buy on a Thursday (Score:5, Interesting)

    by judd ( 3212 ) on Tuesday September 16, 2003 @08:39PM (#6981329) Homepage
    There was an article about an email marketing conference (the legit kind) on Wired news a little while ago - maybe last month? It said that response rates for discretionary spend products were highest on a Thursday. I imagine that if so, spammers know this too, and are sending out on a Wednesday to be in your mailbox Thursday AM.
    • This is interesting information, but how old is it? If it's a recent trend, it's possible that cause and effect have been reversed (that is, it's possible that people spend more on Thursday because they see more ads Thursday morning).

      It's also possible that an advertiser jumped on a statistical anomaly, and feedback caused it to grow from there.

    • I imagine that if so, spammers know this too, and are sending out on a Wednesday to be in your mailbox Thursday AM.

      I think they don't necessarily know this, but many of them might use the same brand of bulk mailing software with this feature included.

  • Different for me. (Score:4, Funny)

    by xanderwilson ( 662093 ) on Tuesday September 16, 2003 @09:11PM (#6981536) Homepage
    I get most of my spam on Sunday and Monday. It'll probably even out when my spammers and your spammers trade lists with each other.

    Alex.
    • Me too. I get barraged every weekend.

      Despite the "Funny" you got, you're probably right. It depends on which spammer crew (in my case, someone sending out emails in Russian with my domain forged in the header) is targeting you.

  • I don't have any hard data but it seems like early in the day (~8am EDT) and later in the day (5-7pm EDT) it picks up too.

    I've kinda assumed this is because the spammers had day jobs and they spammed just before and after work, but it could also be because there is some reason spammers think we are more likely to read it at those hours.

    One last though... isn't regular junk snail mail suppose to be sent to arrive on Friday's for some reason? Because it will sit on your kitchen table on the weekend?
    • My favorite spam are ones that are dated at least several hours into the future. Sure, they appear at the top of my time-sorted mailbox, but they're so easy to pick off. I need to find a filter I can apply with the inbox method I use to delete messages from the future (even after accounting for time zone differences).

  • I spoke with a spammer once (Score:5, Interesting)

    by polyphemus-blinder ( 540915 ) on Tuesday September 16, 2003 @09:18PM (#6981600)
    Don't worry, he didn't leave with his kneecaps.

    But before I uncapped him, I was able to glean this much about their mailing habits: apparently, whether true or not, there is a prevailing idea in the spam community that Wednesday mid-morning is the best time to send spam.

    There idea is that this maximizes the likelihood of it being read; they consider weekends not to be important because people are occupied with funner things than spam; they consider Monday and Tuesday to be "warmup" days into the week, when people may actually be doing work. Thursday and Friday they consider "slackoff" days in which people not only don't do work, but don't read email either. So that leaves Wednesday. And if you analyze your logs further, I bet you'll find that the peak within Wednesday is mid-morning, not the grogy, naptime after lunch hours. That's what I see with my filter, anyway.
    • Don't worry, he didn't leave with his kneecaps.

      I believe it was Swordfish that had the line, "Have you ever tried typing with only one hand, Stanley? Pretty fucking hard typing with only one hand. If you want to keep both, you're going to do this."

  • Not that I can see (Score:5, Interesting)

    by babbage ( 61057 ) <cdeversNO@SPAMcis.usouthal.edu> on Tuesday September 16, 2003 @10:38PM (#6982168) Homepage Journal

    I've been saving most of my spam for the past year or so. A quick scan of my spam folder shows the following breakdown, sorted by frequency:

    887 Mon

    866 Thu
    839 Sat
    830 Fri
    819 Wed
    790 Tue
    743 Sun

    Or, for the same data as a histogram (line length divided by 25):

    743 Sun xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    887 Mon xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    790 Tue xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    819 Wed xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    866 Thu xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    830 Fri xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    839 Sat xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

    Wednesdays are pretty much in the middle of the range (the mean is 824.9).

    The bigger trend I've seen was a big spike back in May, but the rate has sloped off considerably since then, as this chart of month over month spam trends shows (line length is again divided by 25):

    0045 -- 2003 Sep x
    0224 -- 2003 Aug xxxxxxxx
    0252 -- 2003 Jul xxxxxxxxxx
    0626 -- 2003 Jun xxxxxxxxxxxxxxxxxxxxxxxxx
    1602 -- 2003 May xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxx
    0734 -- 2003 Apr xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    0439 -- 2003 Mar xxxxxxxxxxxxxxxxx
    0289 -- 2003 Feb xxxxxxxxxxx
    0235 -- 2003 Jan xxxxxxxxx
    0283 -- 2002 Dec xxxxxxxxxxx

    (The script that generated this is available on request.) A major cause for this change in trends may be a change in email address around then, but even before the switch I was seeing a dropoff in the number of spams I was receiving. If this pattern is more general than just my mailbox, I have no idea what's causing it.

    Disclaimer: no general trends are implied, this is just "back of the envelope" analysis of the spam mail I personally receive. As noted above, if anyone wants the shell scripts that generate these charts, you're welcome to them -- they're just a few lines of Bourne code that scan over my mbox mailboxes. If you use something other than mbox mail storage, the script may or may not do you any good, but if you want it, ask. :-)

    • A simple statistical analysis of your data shows that Sunday is significantly lower than other days, but the variation of other days is consistent with a random Poisson process with constant mean.

      I fitted a generalised linear model with weekday as explanatory variable and count as response. Here's the table of coefficients:

      Coefficients:
      Estimate Std. Error z value Pr(>|z|)
      (Intercept) 6.72143 0.03471 193.642 <2e-16 ***
      DayMon 0.06642 0.04829 1.375 0.1690
      DaySat 0.01079 0.04896 0.220 0.8256
      D

  • This seems to be a trend with legit email too (Score:3, Insightful)

    by SpaFF ( 18764 ) on Tuesday September 16, 2003 @10:44PM (#6982214) Homepage
    At the University where I administer a Linux mail server, I have noticed that my graphs for Incoming mail, Outgoing mail, and Incoming spam always make nice little bell curves every week. For Saturday and Sunday, each graph drops to very low levels (almost flatline when scaled with the rest of the weeks mail). It all shoots up Monday morning starting around 7:30 when everyone gets into work. Tuesday is always a little higher than Monday, and Wednesday is the highest for all Incoming,Outgoing and Spam. Thursday is almost always very close to Tuesday and Friday is almost always very close to Monday.

    This seems to be attributed to human nature. There is more correspondence going on Wednesday's because people just don't feel like doing as much work on Monday's and Friday's.
  • Yes. Spam peaks on Wednesdays. Like, duh.

  • At my site, the overall spam traffic is highest on the weekend but (and I have no clue why) the spam to real users peaks mid-week. The weekend trafic tends to be more baby-name-book-buckshot or (and would I ever love to get my hands on the clowns who think this is clever), "A@...", "B@..." ... "Z@...", "AA@...", "AB@..." ... "AAA@..." and so forth. Frequently, these aren't spam per se, but simply seem designed to illicit a response--one, for example, from a guy claiming he wants to buy a flux capacitor

  • Spam Stats (Score:3, Interesting)

    by annielaurie ( 257735 ) <annekmadison@h[ ]ail.com ['otm' in gap]> on Wednesday September 17, 2003 @12:22AM (#6982933) Journal
    I've noticed the Wednesday peak in the accounts attached to my business. Those are primarily the inkjet cartridge, diploma, "forbidden CD," prescription pharmaceutical, hot stock tip, and those obnoxious idiots at Logosaurus. In other words, the spam has a higher "tone" if you will.

    The spams to my Hotmail account spike on Friday evenings. Those are what I would call the "dregs of humanity" spams--the assorted barnyard animals, herbal enhancements, and general "Are you lonesome tonight" spams. They're also more likely to be inept, such as having a "TO" field that reads "C:\documents\addressfile.txt" or words to that effect.

    Bagnallb at AOL is sort of my own personal spammer (although I share him with many other people on the greater Internet). He really, really wants to take over my domain, and he manifests this by increasingly frenetic efforts to find an obsolete version of FormMail. He's been trying without success for six weeks now, and his efforts always, always increase on Wednesdays.

    So I'd say Wednesdays for the "business class" spam and Fridays for the really scummy stuff. Bagnallb is scummy, but he's a Wednesday sort of fellow.
  • Spammmers take spamming as a job. They think they are working legit Mon-Fri. They also queue up job for the weekend.
  • A client of mine has an online store and while they don't use spam, the access log stats are interesting and may be related to the spam schedules:

    -visits peak on thurdsay and friday, they are lowest on sunday, awstats shows a nice regular curve.
    -visits reach a peak about 10am, stay steady until about 9pm and then fall to lowest at 5am (Central Time)
  • Didn't you know Microsoft sends out their security warnings on wednesdag?
  • that after stamping out trolls from slashdot with the mod system, they went onward and changed their profession to something similar (that is: continue to break the masses's balls - annoy them...)...

    Wasn't Wednesday the trollday?

  • you insensitive clod!

  • Spammer workweek speculation (Score:3, Funny)

    by Experiment 626 ( 698257 ) on Wednesday September 17, 2003 @10:35AM (#6985526)

    Monday - Check mail from the weekend. If no new lawsuits, laze through the day like everyone else.

    Tuesday - Write some spam.

    Wednesday - Send out spam.

    Thursday - Await responses to spam.

    Friday - Deposit ill-gotten gains in the bank, take off early for the weekend.

  • Friday is spam day for me :)

    sales@maficstudios.com [mailto]

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close