Are there any good sources breaking down spam (et al) behavior? I've found some that try to measure, usefully, how much spam, what percentage of email is spam, registrar sources, hosting sources, domains and in particular TLDs most used. Which is fine. But I'm thinking more in the realm of characterizing the spammers themselves. There's too much anecdote in these discussions. For example are there ~20 spam operations which account for 90+% of the spam? What sort of products do the major spammers spam? Wild guess, but I suspect it's something like that, a small set of spammers accounting for most of it and then a rapidly descending long tail. How would you begin to group them? A first try might be by spam content, by apparent customer. And probably stylistically, for example identical embedded HTML or CSS tho that could just be commonly shared packages. But something like that should provide fingerprints with some study just as we do with computer viruses. At least it might begin to suggest what arrowhead(s) to put the wood behind if one wants to disrupt their business models. I realize some want to now argue "but what is spam?" which is a valid question but as with all science and engineering research so long as the methods are transparent and seem reasonable then the results simply are a measure of what they set out to do and you're free to interpret whether they apply to your interests or not. Or provide alternative approaches. But my question is whether anyone is already doing this? P.S. Because I don't think this merits another message: Some here reason that spam is effective and profitable because it persists. That is probably somewhat true for the spamming operations but I wouldn't be so sure about their customers. There's an old joke about an experienced business person saying that only half their advertising is effective -- and if they could ever figure out which half they could save a lot of money! The same might be true of spamming. For example a company might give an advertising broker (numbers just made up) $100K/month to provide an advertising campaign. If $10K/mo of that went into subcontracting spammers but only the other $90K/mo had any effectiveness they may have no way of knowing that so they continue throwing 10% of their budget at spamming operations. Yes there may be ways of trying to measure that, welcome to the realities of the advertising industry as that joke above illustrates. Often all the advertising purchaser can hope for is overall that a $100K spend was profitable for them, it brought in more than $100K revenue even if they have no idea from which campaign. And even that may change over time, spamming for example might work somewhat seasonally or based on other external conditions such as news events, a big competitor's similar advertising campaign elsewhere and now everybody wants blue beer, university schedules, etc. etc. etc. It ain't science. -- -Barry Shein Software Tool & Die | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: +1 617-STD-WRLD | 800-THE-WRLD The World: Since 1989 | A Public Information Utility | *oo*