Does SPAM Peak on Wednesday?

danlor asks: "After installing a pretty good spam filter here at work, we noticed an interesting weekly trend in overall spam intercepts. They peak on Wednesday and trough o n Sunday. It is an almost perfect bell curve. We have gone over this quite a few times here, but cannot come to consensus on why this would be. Could Spammers really be God fearing? Why would Spammers have a 'hump' day?" Has anyone else noticed this trend?

Comments

Re:Maybe they send from work or school?

[GigsVT]

Or maybe they do things on the weekend, like normal people? And don't feel like getting much work done on Monday, like normal people?

I bet if you graphed legitimate business email, it would show the exact same trends.

Spammers are people too, just barely. :)

Not for me

[SeanAhern]

While I don't have the statistics of a multi-user mail server, I do have statistics for myself.

Analyzing 11,560 spam emails that have come to my inbox over the last few years, here is the distribution over the days of the week:

. . . .percent. . . . .1
. . . . . . . . . .8 9 0
. . 0 . . . . . . .0 0 0
Mon xxxxxxxxxxxxxxxx | |
Tue xxxxxxxxxxxxxxxxxx |
Wed xxxxxxxxxxxxxxxxxxxx
Thu xxxxxxxxxxxxxxxxxx |
Fri xxxxxxxxxxxxxxxxxx |
Sat xxxxxxxxxxxxxxxxxx |
Sun xxxxxxxxxxxxxxxx | |

(What a pain it is to get a graph to reproduce correctly on slashdot!)

While it does show a "bell" with a peak on Wednesday and a dip on Sunday and Monday, it's certainly not significant. 20% less email on the lowest vs. the highest day isn't significant in my mind.

(Statistics generated with MailListStat from freshmeat.

Because more people buy on a Thursday

[judd]

There was an article about an email marketing conference (the legit kind) on Wired news a little while ago - maybe last month? It said that response rates for discretionary spend products were highest on a Thursday. I imagine that if so, spammers know this too, and are sending out on a Wednesday to be in your mailbox Thursday AM.

Re:Graphs?

[PD]

I've got some graphs on my own website for the past three weeks, and I also noticed a definite trend toward spam peaking in the middle of the week.

http://www.pdrap.org/spam_statistics/graphs is my web page with the graphs. The total height of the bar is all the mail I've received. The red part is the spam.

The bottom graph is a chart of the accuracy of my bayesian spam filter. In just the three weeks that I've been tracking, the filter has gotten notably worse. I've noticed several spams that seem to be crafted specifically to get around bayesian filters.

I spoke with a spammer once

[polyphemus-blinder]

Don't worry, he didn't leave with his kneecaps.

But before I uncapped him, I was able to glean this much about their mailing habits: apparently, whether true or not, there is a prevailing idea in the spam community that Wednesday mid-morning is the best time to send spam.

There idea is that this maximizes the likelihood of it being read; they consider weekends not to be important because people are occupied with funner things than spam; they consider Monday and Tuesday to be "warmup" days into the week, when people may actually be doing work. Thursday and Friday they consider "slackoff" days in which people not only don't do work, but don't read email either. So that leaves Wednesday. And if you analyze your logs further, I bet you'll find that the peak within Wednesday is mid-morning, not the grogy, naptime after lunch hours. That's what I see with my filter, anyway.

Not that I can see

[babbage]

I've been saving most of my spam for the past year or so. A quick scan of my spam folder shows the following breakdown, sorted by frequency:

887 Mon
866 Thu
839 Sat
830 Fri
819 Wed
790 Tue
743 Sun

Or, for the same data as a histogram (line length divided by 25):

743 Sun xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
887 Mon xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
790 Tue xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
819 Wed xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
866 Thu xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
830 Fri xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
839 Sat xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Wednesdays are pretty much in the middle of the range (the mean is 824.9).

The bigger trend I've seen was a big spike back in May, but the rate has sloped off considerably since then, as this chart of month over month spam trends shows (line length is again divided by 25):

0045 -- 2003 Sep x
0224 -- 2003 Aug xxxxxxxx
0252 -- 2003 Jul xxxxxxxxxx
0626 -- 2003 Jun xxxxxxxxxxxxxxxxxxxxxxxxx
1602 -- 2003 May xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxx
0734 -- 2003 Apr xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
0439 -- 2003 Mar xxxxxxxxxxxxxxxxx
0289 -- 2003 Feb xxxxxxxxxxx
0235 -- 2003 Jan xxxxxxxxx
0283 -- 2002 Dec xxxxxxxxxxx

(The script that generated this is available on request.) A major cause for this change in trends may be a change in email address around then, but even before the switch I was seeing a dropoff in the number of spams I was receiving. If this pattern is more general than just my mailbox, I have no idea what's causing it.

Disclaimer: no general trends are implied, this is just "back of the envelope" analysis of the spam mail I personally receive. As noted above, if anyone wants the shell scripts that generate these charts, you're welcome to them -- they're just a few lines of Bourne code that scan over my mbox mailboxes. If you use something other than mbox mail storage, the script may or may not do you any good, but if you want it, ask. :-)