Glossary of Spam Terms

Here you will find spam terms and other related definitions.

Address harvester

A program that searches web pages and filters newsgroup postings looking for valid email addresses to be used for spam purposes. (See also harvesting.)

Bayesian filtering

A statistical approach to determining whether an email is spam. Based on probability inference techniques pioneered by English mathematician Thomas Bayes. Bayesian filtering is one of the techniques used by Sophos PureMessage to determine if an email is spam or not.

Block list

A publicised list, usually commercial, of IP addresses known to be sources of spam, which can be used to create a network block list to filter out mail originating from these addresses. (See also Real-time Block List.) A block list is also a feature of anti-spam software that allows users to designate IP addresses, domain names and individual email addresses from which no mail will be accepted. (See also Domain Name System Block List.) Block lists are also sometimes called blackhole lists or blacklists.

Complex dictionary checking

A feature of anti-spam software that screens text for rude words and isn't fooled by various spam tricks, such as the replacement of letters with lookalike numerals or characters (such as "1nterest r@te").

CSS spam

Exploits Cascading Style Sheets (CSS), which are used to control the display of web pages, in order to conceal messages in spam. Spammers can also use CSS to recycle old HTML-based tricks which fool spam filters that do not understand CSS.

Denial of Service (DoS) attack

Where a hacker sends attachments or other unusual or excessive traffic in an attempt to bring down email systems.

Dictionary attack

A program that bombards a mail server with millions of alphabetically generated email addresses in the hope that some addresses will be guessed correctly. This technique is also used to crack passwords.

Directory Harvest Attack (DHA)

When a spammer bombards a domain with thousands of generated email addresses in an attempt to collect valid email addresses from an organization. (See also harvesting.)

Domain Name System Block Lists (DNSBL)

Commercial lists of networks that either allow spammers to use their systems to send spam, or have not taken action to prevent spammers from abusing their systems.

False negative

When anti-spam software fails to identify a spam message as spam.

False positive

When anti-spam software wrongly identifies a legitimate message as spam.

Greylist

Senders who are not block-listed (excluded) or allow listed (accepted) can be placed on a greylist. Some anti-spam software can send greylisted addresses an automated response, challenging the sender to confirm their legitimacy.

Hacker

Someone who intentionally breaches computer security, usually to cause disruption or gain confidential information such as financial details. Originally the word "hacker" referred to any person who was into computer technology, but is now commonly used by the public and media to refer to those who have malicious intentions.

Ham

All email that a recipient does not consider to be spam. (See also spam.)

Harvesting

The process of scanning the Internet to identify email addresses in order to create lists for spamming.

Honeypot

A computer system on the Internet set up to attract and trap spammers and hackers. Usually this is a mailserver set up to appear to be an open relay.

Joe job

A Joe job is a spam campaign forged to appear as though it came from an innocent party, with the intention of incriminating or pinning blame onto that party. The innocent party can also suffer from a flood of email bounces caused by the spam campaign.

Listwashing

The process of removing email addresses from a mailing list at the request of the recipients.

Mail drop

An email address set up to receive email resulting from spam sent from a different ISP. The spammer will cancel the account from which the spam originated in an attempt to avoid detection.

Munging

A technique to protect email addresses from harvesting by changing them and rendering them invalid. Recipients of an email from a 'munged' address are told how to decode it, so that they can then reply to a valid address. (See also obfuscation.)

Morph

A method that a spammer uses to avoid detection by anti-spam software which involves modifying an email header.

Mousetrapping

A technique that page-jackers use, so users tricked into visiting an illegitimate site encounter only additional, unwanted pages when they click the Back button to try to escape.

NDR spam

Uses a faked standard email non-delivery report (NDR) that a recipient will think is genuine, tricking them into opening an attachment that is spam. Spammers can send such an NDR directly or make a legitimate server send it for them, adding to its credibility.

Network check (also known as reverse DNS check)

When an anti-spam engine uses a Domain Name System database to check an email's IP address to ensure that it originated from a valid domain name or web address.

Newsgroup

An electronic forum where readers post articles and follow-up messages on specified topics. Often targeted by spammers seeking to harvest email addresses.

Obfuscation

Spammers' attempts to hide data to prevent its detection. Also, when email recipients use HTML or Javascript to obscure mail to links and email addresses so that addresses remain readable and clickable, but cannot be harvested. (See also munging.)

Open relay

An SMTP email server that allows the third-party relay of email messages. The relay feature is a part of all SMTP-based servers and it has legitimate uses, but spammers have learned how to locate unprotected servers and hijack them to send spam.

Opt-in

The process of agreeing to receive email from a business source. Double opt-in refers to a double-check procedure in which a decision to be included on a mailing list is confirmed.

Opt-out

The process of declining to receive email from a business source or unsubscribing if the recipient is already on a mailing list.

Page-jacking

This involves stealing the contents of a website by copying some of its pages, placing them on a site that appears to be legitimate, and having the contents indexed by major search engines, so that unsuspecting users can be tricked into linking to the illegitimate site. (See also mousetrapping.)

Phishing

(Pronounced 'fishing'.) This involves creating a replica of a legitimate web page to hook users and trick them into submitting personal or financial information or passwords.

Phreaking

This involves illegally breaking into the telephone network to make free long-distance phone calls or to tap phone lines. This term is also used to include the act of breaching the security of any network.

Ratware

Software that spammers use to automate spam campaigns, coordinate spam services, and generate, send and track spam messages.

Real-time Block List (RBL)

This differs from a block list in that it actively boycotts TCP/IP addresses known to send spam or host spammers. Enabling such a list results in all mail from those addresses being refused, including valid email. This can, however, result in innocent users complaining to their ISPs and those ISPs enacting stronger anti-spam measures in order to get the RBL ban lifted.

Social engineering

Conning email recipients into opening messages, revealing passwords or providing other confidential information by appealing to their curiosity, gullibility or computing naivety.

Spam

All unsolicited commercial email (UCE) and unsolicited bulk email (UBE) that a recipient does not want to receive. (See also CSS spam, NDR spam, and ham.)

Spambot

A program that spammers use to harvest email addresses from the Internet.

Spam trap

Spam trap is an email address set up by a spam fighter to capture unsolicited email ads for the purpose of tracking spammers. A spam tram is also an option on an online form that is pre-selected by default, so that unwary users opt-in to receive spam. It can also be used to refer to a software filter that blocks email addresses known to send spam.

Spoofing

When spammers forge an email address to hide the origin of a spam message. Email scammers and virus writers also use this trick. Scammers spoof address lines to fool people into thinking an email has arrived from a legitimate source, such as an online bank. Similarly, virus writers have passed off viruses as security patches by spoofing their origin as being, for example, from Microsoft technical support.

Tarpitting

The use of traffic monitoring to identify remote IP addresses sending a suspiciously large volume of email. Access to the mail system from suspected spam addresses can then be slowed or temporarily suspended. (See teergrube or tarpit.)

Teergrube (or tarpit)

An intentionally slow server that aims to trap spammers using harvesting programs.

Web bug

A small graphic inserted in an email or web page that alerts a spammer when a message is read or previewed.

Allow list

A list of external email addresses, IP addresses and domains trusted by the entire organization or individual users. All mail from these addresses is delivered, bypassing the spam filters.

Zombie

An insecure web server or computer that is hijacked and used in a DoS attack or to send spam.

download Download our free Virus Removal Tool
Find what your antivirus missed