eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Spammers are increasingly turning to shortened URLs to beat spam filters, and an old foe is at the center of it.
According to Symantec’s July 2010 MessageLabs Intelligence Report, spam with shortened hyperlinks reached a peak of 18 percent on April 30, translating to 23.4 billion spam e-mails. An analysis of the spam campaign has linked some of it to the notorious Storm botnet, which first appeared in 2006 before declining in 2008. The botnet reemerged in May, and now accounts for 11.8 percent of all the spam containing shortened hyperlinks circulating the Web.
“While botnets are often the source of short URL spam, 28 percent of this type of spam originated from sources not linked to a known botnet such as unidentified spam-sending botnets or non-botnet sources such as Webmail accounts created using CAPTCHA-breaking tools,” Paul Wood, MessageLabs Intelligence senior analyst for Symantec Hosted Services, said in a statement.
The peak of 18 percent in 2010 is more than double last year’s high point of 9.3 percent recorded July 28, 2009. In the second quarter of 2009, there was only a single day when shortened hyperlinks appeared in more than 1 in 200 spam messages, Symantec reported. In the second quarter of 2010, however, there were 43 days when that happened.
Security pros have repeatedly warned users to be wary about shortened URLs in e-mails and on social networks because they are sometimes used to trick people into visiting malicious sites. That wariness should not necessarily transform into panic, as an analysis by Zscaler of shortened URLs in Twitter’s public timeline revealed they were far less likely to lead to malicious sites than search results on Google.
Still, for spammers pushing pharmaceuticals and other goods, using shortened e-mails can be relatively effective. According to the report, researchers found an average of one Website visit for every 74,000 spam e-mails with the shortened URLs. The most frequently visited shortened links from spam received more than 63,000 Website visits.
When it comes to spam, the name of the game is dodging filters, and any tactic that can make it harder to block e-mail messages is going to be adopted by the spammers out there, Wood said.
“When spammers include a shortened URL in spam messages, these shortened hyperlinks contain reputable and legitimate domains, making it harder for traditional anti-spam filters to identify the messages as spam based on the reputation of the domains found in the spam e-mails,” he said.