Re: Worsening google service reputation and abuse

[Barry Shein via NANOG <nanog () lists nanog org>]

Are there any good sources breaking down spam (et al) behavior?

I've found some that try to measure, usefully, how much spam, what
percentage of email is spam, registrar sources, hosting sources,
domains and in particular TLDs most used.

Which is fine.

But I'm thinking more in the realm of characterizing the spammers
themselves.

There's too much anecdote in these discussions.

For example are there ~20 spam operations which account for 90+% of
the spam? What sort of products do the major spammers spam?

Wild guess, but I suspect it's something like that, a small set of
spammers accounting for most of it and then a rapidly descending long
tail.

How would you begin to group them?

A first try might be by spam content, by apparent customer.

And probably stylistically, for example identical embedded HTML or CSS
tho that could just be commonly shared packages.

But something like that should provide fingerprints with some study
just as we do with computer viruses.

At least it might begin to suggest what arrowhead(s) to put the wood
behind if one wants to disrupt their business models.

I realize some want to now argue "but what is spam?" which is a valid
question but as with all science and engineering research so long as
the methods are transparent and seem reasonable then the results
simply are a measure of what they set out to do and you're free to
interpret whether they apply to your interests or not. Or provide
alternative approaches.

But my question is whether anyone is already doing this?

P.S. Because I don't think this merits another message:

Some here reason that spam is effective and profitable because it
persists.

That is probably somewhat true for the spamming operations but I
wouldn't be so sure about their customers.

There's an old joke about an experienced business person saying that
only half their advertising is effective -- and if they could ever
figure out which half they could save a lot of money!

The same might be true of spamming. For example a company might give
an advertising broker (numbers just made up) $100K/month to provide an
advertising campaign.

If $10K/mo of that went into subcontracting spammers but only the
other $90K/mo had any effectiveness they may have no way of knowing
that so they continue throwing 10% of their budget at spamming
operations.

Yes there may be ways of trying to measure that, welcome to the
realities of the advertising industry as that joke above illustrates.

Often all the advertising purchaser can hope for is overall that a
$100K spend was profitable for them, it brought in more than $100K
revenue even if they have no idea from which campaign.

And even that may change over time, spamming for example might work
somewhat seasonally or based on other external conditions such as news
events, a big competitor's similar advertising campaign elsewhere and
now everybody wants blue beer, university schedules, etc. etc. etc.

It ain't science.

-- 
        -Barry Shein

Software Tool & Die    | bzs () TheWorld com             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/COI34LM3DKN23KW2QQGLD6SUSD5ZC2U7/