Combating snowshoe spam with fire

Snowshoe spam is an emerging type of spam which is notoriously hard to detect, as the spammers spread out the sending load over many hosts. More and more spammers make use of techniques like Sender Policy Framework (SPF) to appear more genuine, however, in order to configure SPF correctly a domain name is needed. As result snowshoe spam domains usually contain many records, this makes these kind of domains stand out. In this paper we take a active approach towards detection of snowshoe spam domains using active Domain Name System (DNS) measurements and machine learning. For a few months we have made daily detections where, on average, every day around 240 new domains were detected. We show, by comparing our results with a number of blacklists and a case- study, that our method is able to detect snowshoe domains and can be used to mark emails as spam before the domains appearing in the emails appear on blacklists.