Snowshoe_Spam

Olivier van der Toorn

FOSDEM is a yearly event in the last weekend of Januari (or the first weekend of Februari). FOSDEM stands for Free Open-Source Developer Europe Meeting. At the event state of the art open-source software is discussed, presented and enjoyed. This year there is a DNS devroom. On sunday at 11:35 Olivier will hold a talk there titled ‘Melting the Snow: Using Active DNS Measurements to Detect Snowshoe Spam Domains’.

Olivier van der Toorn

We started the TIDE project with Snowshoe Spam domain detection. But what is Snowshoe Spam? In Snowshoe Spam the spammer tries to spread the sending load over numerous hosts, and thus reducing the amount of spam each hosts sends. This makes each host separate hard to detect. It means that the spammer is less likely to end up on spam reputation lists (blacklists) and is therefore able to continue spamming for longer.