Getting Clueful: Five Things You Should Know About Fighting Spam

The presence of shortened URLs in spam has skyrocketed just in the last few weeks, according to Matt Sergeant, senior anti-spam technologist at MessageLabs.

"We've been monitoring the use of short URLs in regular email spam for the past few months and noticed that it had been used in small spam campaigns. However, in the middle of last week, we saw it increase exponentially, said Sergeant. "It went from practically nothing to 2.23 percent of total spam today (July 8th)."

The technique has picked up speed because the emails are being sent by the Donbot botnet, said Sergeant. The spike indicates that the botnet owner or operator has found a way to automate the creation of short URL links, within the botnet code or the templates that they send out, he said.

"We track this botnet fairly closely and have a fair idea of its size. It's not one of the biggest botnets out there but it sends a high volume of malicious content and is responsible for about 5 million spam emails. "

Dozens of Web sites offer URL-shortening services and spammers have realized that using these services eliminates the need to solve a CAPTCHA or register an account, according to MessagelLabs.

"Previously, when spammers used other services types of services to obfuscate the location of and redirect links, they had to create accounts which require solving a CAPTCHA," Said Sergeant. "URL-shortening services don't require registration to create a short link, and so spammers can easily automate that process. The danger of these short URLs is that you don't know where they will take you. They send an email that's hard to stop with URL blocking services because they can't outright blacklist short URLs in general. The short URL obscures the real domain name. Spammers have been doing this for a while by trying to find redirection services, and this is the next level of that."

While the tactic is new, the spam content, said Sergeant continues to be the typical weight loss and male-enhancement advertisements that include links to a Web site where these kinds of products are sold.