SPAM Archive

This directory contains all the spam that I have received since early 1998. I have employed various "bait" addresses, such as <bait@em.ca> to trick email address harvesters into putting them on spam lists. The archives have been (re)compressed with p7zip which produces files about half the size of tar+bzip2, and smaller even than I was able to achieve with RAR on Linux.

This archive is provided for the purposes of researching behavior of spammers and development of new spam management techniques. Permission is hereby granted to use this archive without restriction. If you publish any research or software based on this archive, I would apreciate a reference to this archive in said work, but it is not required. I would also like to see any such work, and may link it here.

If you have any comments, please e-mail me at bruce@untroubled.org.

NOTE: Most of the messages in this archive contain forged headers in one form or another. The fact that a message claims to have come from one particular address or another does not mean it actually originated at that address. The only way to determine where a message originated is to do a careful study of the Received: headers, and even then much of the information cannot be trusted.

This archive was used in the following reports or sites:

• This spam map which shows where spam has been originating on the globe.

Notes

The number of messages in the archive for 2007 is lower than for 2006 or 2008. One of the spam traps I had in place was a wildcard address. During 2006, this address started receiving increasingly large amounts of spam, making it hard to process the mail effectively. Since it was all duplicates of other spam I received, I disabled the wildcard address. By 2008, the amount of spam to the other addresses had increased back to the same levels.

File Naming

Several people have asked about the file names within the archives. There have been a variety of methods used to move messages from my mailboxes into the archive over time. The formats are:

1. [timestamp].[PID].txt
   This is how qmail produces maildir filenames, with the hostname stripped off.
2. [timestamp].[PID]_[serial].txt
   This is how Mutt saves files, where [PID] is Mutt's PID, and [serial] is a number to make the filename unique.
3. [timestamp].[PID]_[serial].[hostname]
   This is the same as #2, but something didn't strip off the hostname.
4. [timestamp].M[microseconds]P[PID].txt
   This is used by some newer maildir scripts to generate more unique filenames by including the microsecond portion in the timestamp.

Index of spam