Commtouch Reports Spam Trends For First Half of 2004: Viagra is King of Spam, 5 Countries Are Hosting 99.68% of Spammer Websites and Nearly 10% of All Spam is CAN-SPAM Compliant

Business Wire, June 30, 2004

MOUNTAIN VIEW, Calif. -- Commtouch (Nasdaq:CTCHC):

--Offers for drugs, mortgage/refinance and organ enlargement top list of products pitched in spam messages during first half of 2004

--In month of June, US is #1 origin of global spam with 55.69%, while China hosts 73.58% of the web sites referenced in spam messages

Commtouch(R) (Nasdaq:CTCHC), the innovator of anti-spam solutions featuring Recurrent Pattern Detection (RPD)(TM) technology, announced today that the Commtouch Spam Lab has analyzed hundreds of millions of spam messages in the first six months of 2004 and found that in the first half of 2004, offers of drugs was the most prevalent form of merchandising included in spammer messages, representing 29.53% of all global spam. 2004 started with nearly 350,000 unique spam outbreaks per day and the first 6 months end with over 500,000 unique spam outbreaks on a daily basis.

In the first six months of 2004, Viagra appeared in 14.1% of all spam messages -- with 9 percent of those messages advertising only Viagra and the remaining 5.1% selling Viagra in addition to another drug or several drugs. During this same period, spammer offers for mortgage loans and refinance deals was second to drug advertisements, and organ enlargement offers came in third at 7.05% of all spam messages. Also during the first six months of 2004, pornography and casino spam messages declined to rates of 3.1% and 0.45% of global spam, respectively.

The Commtouch Spam Lab reports that most of global spam during the first half of 2004 was written in the English language, with foreign languages employed for just 5.77% of global spam. The company also notes that in June of 2004, China, at a 73.58% clip, led all countries in the hosting of web sites referenced in spam messages. Most of the unsolicited messages sent over the Internet have one or more link (URL) in the message; spammers are setting those links to provide more information regarding the products/services they are trying to promote, or to allow users to buy the promoted products online.

Commtouch notes that in the month of June 2004, 9.8% of all spam was CAN-SPAM compliant, meaning that: the email message has a functioning return email address; a postal address is included in the sent email message; within the email message there is an ability for a recipient to 'unsubscribe'; the subject line of the email is not deceptive; and there is clear and conspicuous identification that the email message is an advertisement or solicitation.

The top products pitched in spam messages in the first six months of 2004 included:

Drugs - 29.53%

Mortgage/Refinance - 9.68%

Organ Enlargement - 7.05%

Shopping - 6.86%

Software sales - 6.11%

Financial - 5.87%

Work from home/jobs - 4.06%

Dating - 3.15%

Porn - 3.1%

Weight Loss - 2.62%

Beauty products/Health - 2.53%

Debt solutions - 2.48%

University Degrees - 2.43%

Vehicle Warranties - 1.86%

While 4.3% of spam messages in the first six months of 2004 had no subject in the subject header, more than a fifth of all spam provides a real challenge to content filters, as Commtouch reports that 21.6% of global spam messages included visible random characters in the subject, body or both. Employing random characters works by adding meaningless letters to the subject or body of an e-mail message or modifying certain words to trick spam filters. 8% of spam messages included personalization in the subject, body or both. Personalization means mentioning of the receiver's name or e-mail address in the subject or the body of the message.

"In the first six months of 2004 we see that with the increase of CAN-SPAM compliant email, there is an increase in the sophistication of spamming methods and tricks in spam email," said Avner Amram, executive vice president at Commtouch. "Spammers use a higher level of randomization, both visible and invisible in their email. Commtouch's RPD is a real-time technology which detects and blocks spam minutes from distribution over the Internet, regardless of spamming methods or tricks, focusing on pattern detection of emails sent en masse. Content Filtering technologies cannot handle the spam problems effectively since they are reactive to spammer tricks, easy to fool and require continuous learning and tuning. The biggest problem with these solutions appears to be their inability to distinct between a 'bad' word which is used in a legitimate email and a 'bad' word which is used in a spam email. Therefore, their false positive rate is high. RPD technology doesn't analyze content and thus is immune to content tricks and can identify spam in any language."

China ends June 2004 hosting most of the web sites referenced in spam email

Most spam that arrives in email boxes contains a URL to a web site within the email. While 49 countries around the world are hosting spammer web sites, only five countries are hosting 99.68% of the global spammer websites. Commtouch detected in the month of June that more than 73.58% of the web sites referenced within spam originated in China, a 4.5% decrease from the previous month. Below are the top-10 countries hosting web sites referenced in spammer emails: