SPAM Archive

This directory contains all the spam that I have received since early 1998. I have employed various "bait" addresses, such as <bait@em.ca> to trick email address harvesters into putting them on spam lists. The archives have been (re)compressed with p7zip which produces the smallest resulting file size of any tool I have tried.

This archive is provided for the purposes of researching behavior of spammers and development of new spam management techniques. Permission is hereby granted to use this archive without restriction. If you publish any research or software based on this archive, I would apreciate a reference to this archive in said work, but it is not required. I would also like to see any such work, and may link it here.

If you have any comments, please e-mail me at bruce@untroubled.org.

NOTE: Most of the messages in this archive contain forged headers in one form or another. The fact that a message claims to have come from one particular address or another does not mean it actually originated at that address. The only way to determine where a message originated is to do a careful study of the Received: headers, and even then much of the information cannot be trusted.

WARNING: I recently have had issues with certain clients refetching these files hundreds of times per day. If I discover you abusing this service, I will block your IP. The files in this directory are updated once per day. There is no point in fetching them more often than that.

This archive was used in the following reports or sites:

• This spam map which shows where spam has been originating on the globe.
• Spamology by Irad Lee
• De Wang, Danesh Irani, and Calton Pu. "A Study on Evolution of Email Spam over Fifteen Years". In Proc. of 9th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom 2013). Austin, Texas, United States, October 2013. Best Paper Award

Notes

The number of messages in the archive for 2007 is lower than for 2006 or 2008. One of the spam traps I had in place was a wildcard address. During 2006, this address started receiving increasingly large amounts of spam, making it hard to process the mail effectively. Since it was all duplicates of other spam I received, I disabled the wildcard address. By 2008, the amount of spam to the other addresses had increased back to the same levels.

At the beginning of April 2018, I let the bruce-guenter.dyndns.org domain name expire. Most of the spam I receive came through that domain name. As such, this archive may not be of much use going forward.

File Naming

Several people have asked about the file names within the archives. There have been a variety of methods used to move messages from my mailboxes into the archive over time. The formats are:

1. [timestamp].[PID].txt
   This is how qmail produces maildir filenames, with the hostname stripped off.
2. [timestamp].[PID]_[serial].txt
   This is how Mutt saves files, where [PID] is Mutt's PID, and [serial] is a number to make the filename unique.
3. [timestamp].[PID]_[serial].[hostname]
   This is the same as #2, but something didn't strip off the hostname.
4. [timestamp].M[microseconds]P[PID].txt
   This is used by some newer maildir scripts to generate more unique filenames by including the microsecond portion in the timestamp.

Index of spam