MessageLabs Researchers Identified Typical Words Used by Spam

MessageLabs Intelligence recently conducted a research according to which spam distributed globally over the internet are of diverse nature, there exists some word patterns, which are to be spotted in the mayhem.

The analysis identified a few poplar words which include: today!, fingertips!, here!, shipping!, online!, medications and available. These words further indicate that of the top six words, 5 are accompanied with an exclamation (!) mark.

Symantec researchers explained that basically, spammers prefer creating a sense of immediacy in the messages they distribute. This is because of the belief that if a person spends less time to think about the words, most probably he won't realize that the message is actually a spam of some sort.

Furthermore, the study also identified that from general spam, there are different profiles of individual botnets. Due to the manner in which they are used, these botnets are likely to carry a rather limited stock of words because they follow some set topics, again limited in number.

Bagel botnets use some set words, which are: goto, favorite, here!, shipping!, fast, etc. Some main words used by Grum botnet are special, discount, code, important, etc. furthermore, Preferred words in Rustock's list are user, prices, dear, supersale, etc; however, Free, here, Viagra, great, etc, are used by Bobax.

The firm observed that compared to the other three, Bobax is somewhat different in nature as more words are used by it that appears in its spam. Still it is apparent that majority of Bobax spam cater to a specific theme.

In contrast to aforementioned four botnets, Cutwail acts in a different way. The botnet does not restrict itself to some set topics, making certain words noticeable from others; it rather possesses numerous diverse topics, which it uses in similar volumes. One reason for such an approach seems to be that instead of standard spam, the botnet is likely to be employed to distribute scores of malware also. To do this, Cutwail has to encourage the gullible user to open up the attached file, and hence the e-mail has to give a legitimate look as far as possible.

Meanwhile, it is to be noted that Symantec arrived at the conclusion by randomly examining a sample of global spam over a week.

Related article: Mozilla Rules Out Bug in Its Firefox

» SPAMfighter News - 3/25/2010