A few days ago someone commented on my blog concerning the timing of spam. When does it happen? During the day? the night? on weekends? So I started playing with numbers.

I like playing with numbers, in case you had not figured that out by now.

I have one phpBB2 board that is essentially inactive except for spammer registrations. I am using data from over five thousand blocked registrations from my Checkbox Challenge MOD for this post. The data has been collected from May 1, 2007 through March 27, 2008, and contains 5,227 rows.

Registration Attempts per Hour

First question: what time of day to spammers tend to hit? It turns out they never sleep:

+------+----------+
| hour | count(*) |
+------+----------+
| 00   |      208 |
| 01   |      194 |
| 02   |      204 |
| 03   |      177 |
| 04   |      187 |
| 05   |      237 |
| 06   |      227 |
| 07   |      224 |
| 08   |      215 |
| 09   |      242 |
| 10   |      230 |
| 11   |      199 |
| 12   |      219 |
| 13   |      222 |
| 14   |      197 |
| 15   |      220 |
| 16   |      224 |
| 17   |      228 |
| 18   |      257 |
| 19   |      209 |
| 20   |      237 |
| 21   |      216 |
| 22   |      223 |
| 23   |      231 |
+------+----------+

And a nice chart to go with the raw data:

The hour in this case is based on central time (US) as that is how I have my server configured. I don’t see a dramatic difference from one hour to the next, although you could suggest that the early morning hours of midnight to 4 AM are the least active in looking at the chart. I don’t know if that is significant enough to warrant special handling or not.

Registration Attempts per Day

Here is the raw data for failed registration attempts by day of week:

+------+----------+
| day  | count(*) |
+------+----------+
| 0    |      659 |
| 1    |      708 |
| 2    |      740 |
| 3    |      828 |
| 4    |      814 |
| 5    |      745 |
| 6    |      733 |
+------+----------+

And as before, a nice graph:

There is a clear surge in activity during the middle of the week, which to me is a bit surprising. I know that based on numbers from a more typical board (with real users) that board activity does increase during the middle of the week. Is that, perhaps, part of what is going on here? Remember that for this board nearly 100% of the registration attempts are spammers. Maybe I should look at numbers from a more “normal” board instead?

Successful versus Rejected Registrations

To answer that question I switched databases. These numbers come from a board with over 30,000 members. The Checkbox Challenge MOD has been running on that board since April 17, 2007 through today, and I have collected 21,652 rows of data. So far.

Here is a chart that compares successful passes through the checkbox challenge versus failures ranked by day of the week. I should add that this board is a “professional” board and therefore we do most of our activity on weekdays. As you can see, we get fewer registrations on the weekends than during the week. But as before, the spammers never sleep. There is a slight drop on weekends, much like the chart from the other board, but not nearly as much as the drop for valid registration attempts.

If I use the data from my larger board to check registrations by hour, here is what that chart looks like:

Conclusion

What does all of this mean? Good question. I do not allow guest posting, so I don’t have any statistics on that. I don’t collect password information during the checkbox challenge (for privacy reasons) and therefore I don’t have any data on that. I do collect email addresses and IP information, and I have not talked about either of those attributes here. I am only looking at time of day or day of week. But even with that, I can conclude is that spamming is a 24×7x365 effort. I think that is to be expected, since 99.9% of spamming does not come from human interaction but from scripts or registration bots.

And unfortunately, bots don’t need to take breaks.