1

Background

I am working with email headers for spam detection. Each E-Mail header contains many "Received:" headers fields. Each "Received:" header is added by an intermediate Smtp/Mail server in the path from the origin of the e-mail to its destination.

I read in a research paper that the number of intermediate Smtp/Mail server encountered in that path is high for legitimate mail and less for spam mail.

Here is the explanation provided: "spammers have exploited a predefined relay servers for delivering their spam, so the number of hops is limited, while in the normal case the number of relay servers may vary according to the paths the message follow to reach its final destination."

Thoughts:

The path of normal mail would be: Mail User Agent, to sender's Mail Transport Agent, to destination Mail Transport Agent (IP obtained by MX Query) or chain of destination Mail Transport Agents inside the destination domain.

For spam mail, the path should be: spammer to open relay server, open relay to destination MTA, or chain of destination Mail Transport Agents inside the destination domain.

So,the hops encountered would be nearly same.

Query:

Can someone explain if the above analysis is correct? How it is that number of hops encountered by legitimate mails are more compared to spam mails and why the research says "spammers have exploited a predefined relay servers for delivering their spam, so the number of hops is limited"

3

This is probably correct in a statistical sense. A legitimate e-mail will probably (but not certainly) go through several hops not only on the destination side (which are mostly always the same for a given recipient, so that number is not interesting) but also on the sending side, and these will be recorded in Received headers.

A spam, however, while sent by a relay, is often sent by a non-smtp relay or by a trojan on an infected PC. These vectors will not add Received headers. The spam will only have Received headers if it is relayed through a legitimate server (there are several advantages and disadvantages to doing that, it is not a very common choice as far as I can see) or if the spammer wilfully adds fake Received headers in an effort to confuse people or anti-spam programs that try to analyze the headers (and that is passably common).

So, statistically it does not surprise me that spams on average have less Received headers than legitimate mails. However, apart from adding this to some Bayes filter criteria in a sufficiently low-profile way that the major spammers out there do not start adding masses of fake Received headers to their junk, I don't really see a way you can make use of this insight.

  • But I am able to distinguish Spam from Ham,using this Feature,which is a good sign,but mayn't work in future.Any Good Feature ,that can be used? – user10012 Jun 25 '16 at 5:06
  • 1
    The problem is that the better the feature you find, the more likely it is that spammers will work to compensate and to reverse it. Most people use anti-spam programs that take into account hundreds and thousands of such characteristics. Spamassassin is an open-source example. I felt sure that Spamassassin would already have this rule, but I can't find it after a whole minute of googling. It would be trivial to add it if it really doesn't exist, though. – Law29 Jun 25 '16 at 6:42
  • will adding fake headers,not create a problem for spammers?I read an article,which guides how to identify forged received headers,an anti-spam program can easily detect it and classify the mail as SPam. – user10012 Jun 27 '16 at 11:25
  • That's War for you :) Yes, Received headers can be analyzed, and I can usually spot forged ones easily, and I'm sure dedicated anti-spam programs have methods to do so. No, creating them does not really create problems for the spammers, they just try any which way and hope their junk goes through. – Law29 Jun 27 '16 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.