The biggest aspect that used to be used in spam detection (from an OSI, not a content reading perspective) was source IP blocks.

Many people dont realize that spam was the original source for social networking...

I cant type up all the history I know quickly, but Friendster (who 'invented the social graph', HI5, Tagged, MySpace, were all started as an overlay to email harvesting mechanisms to --> spam....

They needed to create high value email-lists of valid emails.

Asking for such, was stupid as most people rejected it.

Then, they figured out that adding a service (chat and share with your friends, give us your email and their email so we can connect you by sending them invites etc) was the best social-engineering (the 'hacker' meaning) mechanism was to have people validate their personal email, offer a novel e-'service' to 'connect' with your friends within some context - and have you pre-validate the email list based on your invites and contacts... then parlay MLM structure to create better more validated email lists.

Then you sell the lists on the BM to spammers looking to avoid a high bounce rate based on real emails.

Then they started nefariously stealing your contacts with auto-opt-in agreements and such....

Then as the battle btwn spam and socially-interesting services ramped up the spam companies (such as Postini (which was bought by google) became the spam filters (selling their services to BigCorps) began to realize that filtering on the sending IPs was a good measure for determining spam (along with rate-limiting, and other aspects) - such that spammers were getting blocked based on delivery IP blocks.

This set-off a market incentive for spammers to buy up swaths of IPv4 blocks so they could swap out IPs...

Then there were many ranges, sources, tracrts etc used to determine senders and ID them as spammers etc....

So - the spammers invented VPN/Tunneling delivery routes such they could send to a number of various global relays so that they could send from a central source of machines, but be delivered to the endpoints from a variety of global IP blocks.

There was a market for IPv4 blocks all over the world and spammers were spending big bucks on all aspects, from paying for the IP blocks, relationships with ISP/VPN/etc tech....

All while attempting to provide what was a thin layer of utility service to the user to keep what was effectively continued access to the growing address books of their users and keep them engaged on the platform such that they could keep knowing if existing or new contacts were valid.

There were even back-room deals between spammers/tech/isp etc to allow access.

So, the "social networks" we know know of were birthed literally upon spam.

-

Have you ever wondered why as soon as tiktock came out, all of a sudden a fuck-ton of spam was hitting your gmail inbox (previously postini) <-- Because tictock was eating the revenue lunch.

Zuck literally stated that the entire revenue model for FB was "senator, we sell ads"

When in an interview with Google, they asked "what kind of company do you think google is "Well, most people think youre a search engine, but youre actually an advertisement correlation engine"

In an interview with Twitter (dont forget about the infamous ATT room 641A?) - what do you think twitter is: "Twitter is a global sentiment monitering engine" (this was ~2006?8? I cant recall)

--

Source: I know these founders and many of the original devops members from the above companies, and other more scary outcomes from the above statements.

And here we are today with the advanced learning all built upon "consumption" ad algos