Report warns on growing risk of fake URL shortening services

The May 2011 report notes that - for the first time ever - spammers are now establishing their own their own fake URL-shortening services to perform link redirection.

This new spamming activity, the analysis says, has contributed to this month's increase in spam by 2.9 percentage points, a rise that was expected following the Rustock botnet takedown in March.

Under the scheme, shortened links created on these fake URL-shortening sites are not included directly in spam messages.

Instead, says MessageLabs - a division of Symantec - the spam messages contain shortened URLs created on legitimate URL-shortening sites.

These shortened URLs then lead to a shortened-URL on the spammer's fake URL-shortening Web site, which in turn redirects to the spammer's own site.

Paul Wood, MessageLabs' senior analyst, said that his team has been monitoring, for several years, the way in which spammers abuse URL-shortening services using a variety of different techniques.

It was, he explained, only a matter of time before a new technique appeared, although, what is unique about the new URL-shortening sites is that the spammers are treating them as `stepping stones.'

They are, he says, a link between public URL-shortening services and the spammers' own sites.

Woods goes on to say that the domains used for these fake URL-shortening sites are being registered several months before they are actually used - a ploy designed to take advantage of the fact that the age of a domain is counted towards its legitimate status.

"With legitimate URL-shortening services attempting to tackle abuse more seriously, spammers seem to be experimenting with ways to establish their own services to better avoid disruption", he said, adding that, as long as new URL-shortening services are being created, MessageLabs expects spammers to continue abusing them.

Delving into the May report also reveals that the global ratio of email-borne viruses in email traffic from new and previously unknown bad sources was one in 222.3 emails (0.45%) in May - a decrease of 0.143 percentage points since April.

Phishing was also down, as during May, MessageLabs reports that phishing activity was 1 in 286.7 emails (0.349%), a decrease of 0.06 percentage points since April.

The report notes that when analysing web security activity, there are around 3,142 web sites each day that were found to be harbouring malware and other potentially unwanted programs such as spyware and adware.

This was, says MessageLabs, an increase of 30.4% since April.

What’s hot on Infosecurity Magazine?