You can tell that an anti-spam tool is becoming too effective when spammers start trying to work around it. <\/p>\n
Such is the case with Spam URL Blacklists (SURBLs), which list domains advertised via spam. Spamfilters will intercept emails that mention blacklisted domains used in clickable links. The spammers can use fake sender addresses and send email from cracked hosts and cracked third party mail accounts, but they still get caught as soon as they mention their websites. This hurts spammers because they only make money when people go to their websites and hand over their credit card details to order fake Rolexes, pills, porn, etc.<\/p>\n
To get around this, spammers have been using pages created at free webhosting services and other third party sites where content can be uploaded. The links only mention the free hosting site, which then redirects to the final spam site.<\/p>\n
One service abused for this is Google Groups. Other services recently seen used are Google Docs, Microsoft Spaces Live and Geocities. In the case of Google Groups the spammers create mailing lists and upload a spam link to the home page of the new group. They never use the groups for their intended purpose, i.e. mailing lists. This effectively makes it impossible to report the abuse via Google’s abuse handling procedures: Any archived posting or uploaded document on the Google Groups service has an abuse reporting link, but the home page of the group itself does not! Obviously, Google never envisaged that spammers would create groups only to have one page of web content that can be advertised via spam.<\/p>\n
Here is an example of a spam:<\/p>\n
Received: from host34.net215.omkc.ru (HELO host34.net215.omkc.ru) [217.25.215.34]
\n by mymailhost<\/tt> (mx077) with SMTP; 21 Jan 2009 04:21:47 +0100
\nMessage-ID: <47940FC9.1016287@verizon.net>
\nDate: Mon, 21 Jan 2008 03:21:45 GMT
\nFrom: arturo <arturo.matthews1@verizon.net>
\nUser-Agent: Thunderbird 2.0.0.19 (Windows\/20081209)
\nMIME-Version: 1.0
\nTo: mymailbox<\/tt>
\nSubject: Brighten Your Day
\nContent-Type: text\/plain; charset=ISO-8859-1; format=flowed
\nContent-Transfer-Encoding: 7bit<\/p>\nAfter trying out tooth whitening system AT NO COST TO YOU you’ll realize that your smile is irresistably contagious! \ud83d\ude09<\/p>\n
http:\/\/groups.google.com\/group\/fkvrqzzzjckhj<\/p>\n
(Add S+H)\n<\/p><\/blockquote>\n
The page advertises “Click Here – Free Credit Score & Debt Help” which is a spam link using the domain white-teeth2009.com<\/tt> hosted on IP address 220.164.144.205 in China. It is listed on four sub-lists of SURBL (WS, OB, AB and JP). Its name servers are ns1.dckfdc.com and ns2.dckfdc.com. Other domains by the same spammers are whiten-your-smile2009.com and smile-really-great.com.<\/p>\n
At the very least Google should add an abuse reporting link to its Google Group pages. It would be even better if they were to check uploaded Google Group content and checked any URLs in it against spam blacklists such as SURBL. This would stop the spammers in their tracks.<\/p>\n","protected":false},"excerpt":{"rendered":"
You can tell that an anti-spam tool is becoming too effective when spammers start trying to work around it. Such is the case with Spam URL Blacklists (SURBLs), which list domains advertised via spam. Spamfilters will intercept emails that mention … Continue reading