Clearswift's Spam Index: Spammers Increase Sophistication to Evade Detection; Subtle Tricks Are in, While 419 Scams Are Out.

REDWOOD CITY, Calif. -- Thought spammers had run out of tricks? Not just yet. Unsolicited e-mail content is continuing to evolve in an ongoing effort to bypass security defenses, according to Clearswift's Spam Index, the technology industry's most in-depth analysis of unsolicited e-mails.

Through analysis of tens of thousands of individual e-mails, Clearswift has identified increases in spam using genuine Web sites as "jump-off points," enabling spammers to avoid anti-spam defenses. The jump-off points direct e-mail users who click on links to the spammers' sites via legitimate sites such as Yahoo! and Geocities. These are not on the banned list of anti-spam databases, and are therefore not blocked.

Also evident is more sophisticated sentence randomization -- a move away from the random passages taken from novels or dictionary definitions, or more obvious ploys such as word obfuscation (seen in messages that advertise V1agra, Levitr@ or C!ialis).

"It might look like we're getting the same old offers," said Alyn Hockey, Clearswift's director of research, "but the spammers are definitely making subtle changes to increase their efficiency at penetrating our e-mail systems."

As new spam methodologies emerge, old ones are dying out. The infamous Nigerian 419 e-mails now account for only 1% of all scams, and just under 0.1% of all spam.

"Nigeria's major police operations against e-mail fraudsters in Lagos are likely to be a factor in this trend," said Hockey. Indeed, reports from Nigeria's Economic and Financial Crimes Commission in August 2005 revealed that cash and assets worth more than $700 million have been recovered from suspects since 2003.

Given the popularity of online gambling, it's perhaps surprising to see spam in this category decrease from 2.2% of the total to 0.01%. The old perennial, health care, has subsided by 9% compared to last month to make up only 32.5% of all unsolicited mail. Elsewhere, fluctuations have been minimal. Financial spam has risen from just over 31% to 33% overall, whereas product-related spam has increased by fewer than 5%, and presently stands at 18.3%.

Exploiting users' interest in current affairs, spammers have also begun to craft e-mails purporting to be "nationwide surveys" on matters of public interest, asking "Do you support the war in Iraq?" and "Is our president doing a good job?" Visa gift cards or laptops are offered as incentives to give the e-mails a greater air of legitimacy.

Clearswift strangest spam of the month

"Which free diapers do you prefer? Make your choice and claim one year's supply of FREE diapers!"

About the Spam Index

The spam categorization statistics were extracted from the millions of spam e-mails harvested by Clearswift's seed accounts on a weekly basis. They are collated and analyzed using Clearswift's spamActive service, which is an integral component of the multilayered anti-spam protection offered by MIMEsweeper for SMTP 5.1. Updated eight times daily, spamActive routinely extracts spam terms, sender domains, URLs and subject lines, which can be automatically downloaded to update customers' e-mail policies.

About SpamLogic(TM)

SpamLogic is a finely tuned solution, which screens all e-mail based on source, content and destination, as well as all e-mail attachments and executables. The anti-spam solution features a battery of defenses that have been organized in a unique way to deliver near-perfect accuracy. The integrated defenses include Bayesian Analysis, which is tuned for probability profiles that best reflect what is and what is not spam; and textual analysis, which helps SpamLogic understand the terms and tricks spammers use to bypass traditional anti-spam solutions.

SpamLogic is available on MIMEsweeper for SMTP and the MIMEsweeper Appliance.

About Clearswift

Clearswift secures content and protects against digital attacks by enforcing security policies that increase productivity, reduce IT costs and create a safer business environment. Its world-leading business is founded on providing Total Content Security for e-mail and Web.

The Internet is an invaluable business tool, but with it comes a harrowing collection of threats. Protecting against the circulation of inappropriate images and text, spam, breaches of confidentiality, and viruses is now mission critical.

Clearswift enables organizations to protect themselves against digital attacks, meet legal and regulatory requirements, implement productivity-saving policies, and manage intellectual property passing through their network.

Clearswift, MAILsweeper, MIMEsweeper, spamActive and ENTERPRISEsuite are trademarks or registered trademarks, in the United States, United Kingdom and certain other countries, of Clearswift Ltd. Additional company and product names may be trademarks or registered trademarks of the individual companies and are respectfully acknowledged.