For example, one of the most difficult kinds of spam facing the filtering companies today is “stock spam”—spam that promotes a stock worth only a few pennies. Several studies have shown that stocks advertised in this manner generally jump for a few days and, as a result, the spammers can make thousands to tens of thousands of dollars for each batch of messages they send out. But stock spam is particularly difficult for spam filtering companies because there is no consistent brand name, phone number or website URL to be blacklisted. “All you have is a stock ticker symbol,” says Sergeant.

Dodging Blacklists
One way that spammers are avoiding the blacklists is by being much more selective in the way they send out spam. For example, says Sergeant, instead of sending a million messages from a single machine, spammers might instead send a thousand messages from a thousand machines. This is especially a problem when those machines are also sending legitimate e-mail, as might be the case when the infected machines are sending spam through the mail servers of their respective ISPs. Right now, says Sergeant, one of the biggest problems for his companies is the large number of relatively small and poorly administered Internet service providers doing business in the developing world.

Another big problem facing antispam companies is that individual spam messages are undergoing more processing by spammers and, as a result, can be more different from each other. “The arms race is chasing how these guys are morphing the context” of the spam, says Scott Petry, Postini’s founder and CTO.

The arms race is also moving into new areas. For example, both MessageLabs and Postini have antispam systems available for instant messaging systems. Recently the folks at Postini got an e-mail about spam on a public-access Web calendar: Somebody had added a repeating event advertising a mortgage broker.

MessageLabs and Postini operate as service bureaus. Companies that subscribe to these firms set up their name servers so that incoming e-mail gets sent directly to one of the bureaus’ data centers, where the mail is received, filtered, optionally archived and eventually sent to the intended destination (or not). One of the big advantages of this model is that the spam that’s filtered out never reaches the customer, so the customer doesn’t need to invest in servers, hard drives and Internet capacity to handle the spam. But a real disadvantage with this approach is that the spam kept in quarantine, including false positives, is usually deleted—typically after 30 days.