What is email SPAM and how can it be reduced?

SPAM - What is it?

On an average day the University receives in excess of 160,000 emails. Of this approximately 30% is blocked as being SPAM.

E-mail SPAM is the practice of sending large quantities of unwanted e-mail messages, frequently with commercial content, indiscriminately. Worldwide it is estimated that in excess of 70% of all email is SPAM. It is a problem, not just for the University of Warwick, but for businesses, other universities and individuals.

What does ITS do to reduce the amount of SPAM?

Warwick is unfortunately a very visible target for spammers, as so many email addresses are in the public domain. It can quickly be deduced, from the University's website, that addresses are in the form of firstname.surname@warwick.ac.uk. From this names can be guessed, or randomly generated, and enough will get through to make it viable for spammers.

There are a number of actions ITS takes to reduce SPAM via the use of rules for incoming mail. For example:

• We don't accept mail from mail relays which are are on 'blacklists' i.e. they are known to propagate SPAM

• The 'From' address is checked to see if it is genuine

• The message is checked for obvious SPAM phrases
  

The full list of checks is available online at http://spamassassin.apache.org/tests_3_2_x.html

Each message is awarded a score based on all the rules - above a certain level the message is blocked as being SPAM. It is unfortunately not possible to block all SPAM, as a stricter filtering policy would lead to false-positives, where genuine email was being blocked as SPAM, which is obviously undesirable.

Is there anything I can do to reduce the amount of SPAM I receive?

To help reduce the amount of SPAM you receive:

1. Protect your address - think carefully about where you use your Warwick address for registering with websites

2. List your address carefully on the Warwick website - your address can easily be found and targeted if publicly visible (see further information)

3. Don't Click 'Yes' to Read Receipt Requests - if you recieve any email you suspect to be SPAM/JUNK and are asked for a Read Receipt, select No or Ignore. Sending a Read Receipt will confirm your address is valid and it is then likely to be passed on to other SPAMMERS.

4. Look out for 'phishing' emails - Increasingly SPAM is being sent from compromised email accounts, which are being used to send SPAM without the owner?s knowledge. Email accounts become compromised when the owner provides their account details - username and password.

   IT Services will never ask you for your username and password via email.

5. Create your own rules within an email client - within most email clients, you can create your own rules to automatically filter out unwanted emails.
   

If you have any doubts about an email you have received, or are concerned that you may have revealed your account details please contact the IT Services Helpdesk on 73737

Further Information

Registering for websites

Think carefully about using your Warwick address when registering for websites. Many websites will, legitimately, sell their address lists on to other organisations, including those who are involved with unsolicited emails.

If you just need an address to register, and have no desire to receive emails, you can use spam@warwick.ac.uk as a valid account to register with. However, please be aware that this mailbox is not checked and all emails received will be periodically deleted.

Alternatively, you may want to create another ?disposable? address via a free email provider (gmail, hotmail etc)

List your address carefully on the Warwick website

If you use SiteBuilder to edit your web site, list your email address using the convention [email]firstname.surname@warwick.ac.uk[/email] - this means that it remains secure and free from detection from most spam bots. If you don't use SiteBuilder for your web site, you could re-write your email slightly using (at) not @, as it won?t be picked up by web site ?crawlers?. Alternatively you may wish to consider removing it completely; people who wish to contact you will still be able to do so via the ?People Search? facility on the website.

?phishing? emails

Increasingly SPAM is being sent from compromised email accounts, which are being used to send SPAM without the owner?s knowledge. This also complicates efforts to track down spammers as they are hiding behind legitimate email accounts.

Email accounts become compromised when the owner provides their account details - username and password. These are usually obtained via a ?phishing? email - these emails are emails which purport to be genuine in an attempt to trick you into revealing personal information, usually with a plausible reason to do.

If you suspect you have received a phishing email you can report it to us at helpdesk@warwick.ac.uk

IT Services will never ask you for your username and password via email

?Phishing? emails are also used to try and obtain other personal information, for example bank account details, they can be easily spotted as they will:

1. Contain no personal information about you
Usually they will start with ?Dear Customer? or similar, rather than addressing you by name. Many companies have now started to include other unique information, such as your postcode or last few digits of your account, so that you can be sure an email is genuine.

Unusual, or incorrect, spellings and grammar
SPAM may often be written in another language and translated into many other languages, resulting in unusual literal translations. For example ? ?Hello My Friend! I hope you can this message without effort - and I will hope very much that I have executed all truly and you can read my message which I direct to you for the purpose of our personal acquaintance.?

SPAM emails are also likely to contain a selection of phrases designed to scare individuals into taking action, without really thinking. For example ?Act Now to avoid account termination?.

2. It?s too good to be true
If it sounds too good to be true, it almost certainly isn?t true.

?Can you help me move money out of...........?

?You?ve won first prize/the lottery etc.............?

?You?ve been named in the will of.....?

These are all recognised and long established scams.

http://www.bbc.co.uk/blogs/watchdog/2008/10/the_419.html

3. Unusual Web Link - Check Carefully!
While the link you see in the email may well be as expected e.g. http://www.amazon.co.uk when you hover over the link your browser will show what the link actually is. Try it with the address here - if you are using Internet Explorer the actual link will show at the bottom left of the screen.

URLs can also just be an IP address (set of numbers) rather than a standard link. Alternatively the link contains no reference to the company you would expect. A note of caution that increasingly spammers are using links which are similar to genuine links, which on first glance could be missed e.g. faceebook.com

4. Ask for personal details
Any reputable company or financial institution will:

• NEVER send you emails asking you to confirm or change your details
• NEVER advise you by email or text message that your account will be suspended if you do not follow the message instructions
• NEVER send you an email or text message containing a link to a log in page

If you have any doubts about an email you have received, or are concerned that you may have revealed your account details, please contact the IT Services Helpdesk on 73737

?

Source: http://www2.warwick.ac.uk/services/its/servicessupport/email/liveemail/faqs/spaminfo/

Phyllis Diller Darla Moore newsweek Tony Scott UFC 151 empire state building prince harry