The Fifth Conference on Email and Anti-Spam (CEAS) was recently held in Microsoft Research Silicon Valley, Mountain View, California.  In addition to Microsoft, this yearly event was sponsored by IBM, Google and AOL.

An interesting paper was accepted at the conference.  “Do Zebras get more Spam than Aardvarks?” was submitted by Dr. Richard Clayton.  In this paper Dr. Clayton and his research team indicate email addresses that start with the letter “a”, referred to as aardvarks receive way more email than email addresses that start with the letter “z” which are referred to as zebras.

From his computer laboratory at Cambridge University, United Kingdom, Dr. Clayton says in his research paper “an analysis of trace logs of email received by a large UK ISP. The log showed a considerable disparity between the proportions of spam received by email addresses with different first characters. This disparity is quite marked when only email addresses that appear to be “real” are considered. Dr. Clayton explains the root cause is likely to be spammers using dictionary’ or Rumpelstiltskin’ attacks to guess valid email addresses. There is limited evidence for these attacks taking place in real-time, suggesting that most “fake” email addresses were constructed sometime in the past and are now immortalised within spammer databases.”

Further validation was provided on some methodologies spammers use to accomplish their electronic sortie missions. Dr. Clayton’s team provided measurements in the way spammers create and use lists of email addresses. Initially they collected valid addresses by consulting mailing list archives, scanning Usenet feeds, scraping’ websites and so on. Systems that would once have permitted these addresses to be validated (delivery failures, the SMTP VRFY command etc.) are generally disabled nowadays, because other spammers were guessing addresses and using these `oracles’ to validate their guesses.

One of the research team’s conclusions was measuring incoming email showed the first letter of email addresses makes a definitive difference to the proportion of incoming spam.