Overview
In August, Proofpoint researchers examined election-related spam, specifically querying subject lines for occurrences of "trump", "clinton", or both. With the election now just over a week away, we returned to our message statistics and found a number of noteworthy differences between the two time periods. These differences point to changing behavior by spammers as the campaigns entered the later stages of the US Presidential contest:
- Overall volumes fell dramatically in August and September and rebounded in October as we drew closer to the election (Figure 1)
- Mentions of both candidates as a percent of total election-related spam increased by almost 6% since a July low. Emails mentioning just Clinton or both candidates now account for almost 17% of total election spam versus a low of less than 4% in July.
- However, Trump-themed spam still dominates: In October, at its lowest point, Trump-themed spam outnumbered Clinton-themed spam by almost 9 times. However, this represents a five-fold decrease from July when Trump-themed spam outnumbered Clinton-themed spam 45:1
- Spikes in election spam corresponded to high-profile election events, such as the Presidential and Vice-Presidential candidate debates.
Figure 1: Overall spam volumes by candidate from June through October
Analysis
When we scanned subject lines in spam email messages detected across our customer base in June and July for occurrences of "clinton" or "trump", the overwhelming majority of election-related spam featured only the string "trump". For example, "did trump just win the election with his latest announcement?" was designated a Trump-themed message for our analysis while "trump destroys hillary clinton with latest announcement" would be categorized as both candidates.
In June in particular, two very large Trump-themed campaigns resulted in Trump appearing alone in over 94% of total election-related spam. That percentage increased to 96% in July. Spam featuring both candidates accounted for almost 8% of election-related spam volume in the last month. In contrast, it represented only 1.8% at its lowest in July. Clinton-themed spam increased each month from less than half a percent of total election spam to over 9% of the total in October. These relationships are summarized in Figure 2.
Figure 2: Percent of total election spam for Trump, Clinton, and both
While June remains an outlier because of two very large Trump-themed campaigns, the ratio of Trump-themed spam to spam featuring Clinton or both candidates has decreased over the last several months (Figure 3). In October, at its lowest point, Trump-themed spam still outnumbered Clinton-themed spam by almost 9 times. However, this represents a five-fold decrease from July when Trump-themed spam outnumbered Clinton-themed spam 45:1.
Figure 3: The ratio of exclusively Trump-themed spam to spam featuring exclusively Clinton or both candidates has generally decreased as the election progressed
We also observed potential trends based on major events in the campaign over the last month. For example, the first presidential debate was followed by five days of steadily increasing volumes for both Clinton- and Trump-themed emails. While it is impossible to directly link events such as debates to changes in spam volume, there does appear to be significant correlation between spikes in spam and specific events that increase voter interest and attention. It follows that increased voter interest creates additional opportunities for spammers to capitalize on the human factor and recipients' willingness to open emails related to the election.
Given these potential relationships, we re-examined all spam data beginning in July, looking for events that coincided with spikes in spam volumes. A sampling of these events are noted in Figure 4.
Figure 4: Spam volume trends by candidate for July-October
As the longer-term trend shows, spikes in the volume of messages that leverage the candidates’ brands correlated to significant events in the election, such as debates and news coverage, particularly related to the Trump campaign. Similarly, increases in Clinton-themed spam corresponded roughly to her improving poll numbers and more prominent profile closer to the election.
Emails
As in our previous analysis, we observed email samples that were both graphical and text-based. The majority included links unrelated to the election such as
- Work from home sites
- Health supplement sites
- Offers pages
- Affiliate pages generating money for referrals
Figure 5: A fake Forbes article leading to a work from home site
Figure 6: A UK version of this article leads to a money-earning scheme while the version distributed in the US leads to the "brain pill" site
Others included election- or candidate-related articles and links. An examples of this is shown in Figure 7 below.
Figure 7: Links and a video featuring pro-Trump materials as well as an ebook purchase link for Surviving the Final Bubble
Conclusion
We know that spam actors track trends and events to increase the effectiveness of their email operations. The election just happens to provide us with an opportunity to observe how this changes over time and in relation to multiple events throughout the election cycle. The relative brand strength of the candidates also appears to correlate to increases in spam volume: as Clinton's poll numbers improved in relation to Trump's, the proportion of messages referencing Clinton or both candidates also increased.
The contentiousness of this particular election has also provided ample opportunity for spam actors to create compelling lures that can trick even savvy users into opening emails and clicking through links. However, all of the usual rules of email hygiene still apply, no matter how tempting the clickbait in the leadup to November 8.