Spammers use legit websites to get through

Stan Beer
Monday, 10 October 2005 11:00

Business IT - Security

Last month saw an increase in spammers using legitimate websites as jump off points to avoid anti-spam defences. According to a new report, spammers put links on sites such as Yahoo! and Geocities, which when clicked on take unsuspecting users to spam sites.

According to the Clearswift September Spam Index, spammers are getting smarter and more sophisticated in sentence randomisation, moving away from random passages taken from novels or dictionary definitions, or more obvious ploys such as word obfuscation (seen in messages that advertise V1agra, Levitr@ or C!ialis). However, the old scams and spams appear to be dying out to replaced by newer breeds.

“They might look like the same old emails but spammers are making subtle changes to increase their chances of getting through blocking systems,” said Peter Croft, managing director Clearswift Asia Pacific.

While new spam techniques are making an appearance on the Spam Index, old ones are dying out.  The infamous Nigerian emails accounted for only 1% of all scams, and just under 0.1% of all spam.

“Nigeria’s police operations against email fraudsters are likely to be a factor in this trend,” says Croft.  Nigeria’s Economic and Financial Crimes Commission reported in August 2005 that cash and assets worth more than $700 million have been recovered from suspects since 2003.

Online gambling spam decreased from 2.2% of the August total to 0.01%. Healthcare dropped by 9% from last month to make up only 32.5% of all unsolicited mail.

Spammers have also looked to capitalise on current affairs by sending emails claiming to be nationwide surveys on matters of public interest, such as “Do you support the war in Iraq?”  Visa gift cards or laptops are offered as incentives to complete the survey – and confirm to spammers that they have a live address.

The figures come from spam filtered by Clearswift for its 20 million users worldwide, analysed and collated by its spamActive service.