Birds of a feather flock together: The accidental communities of spammers

Outbound spam email is a serious issue for Email Service Providers (ESPs). If not resolved, or at least sufficiently mitigated, ESPs may incur higher costs and suffer damage to their reputation. In this work, we investigate the early detection of spamming accounts hosted by ESPs. Our study is based on a large real-life data set, consisting of mail logs involving tens of millions of email accounts hosted by a large, well-known, ESP. An analysis of our data set reveals that spammers tend to be clustered in the same communities within the graph induced by inter-account email communication. The reason for this phenomenon is, most likely, that spammers often use the same techniques for harvesting email addresses. As a result, they inadvertently spam each other or spam the same legitimate accounts. We leverage this accidental community structure for devising a highly accurate spammer detector that outperforms previous algorithms by a wide margin.