New 'trick' in email spam

[krissel]

This won't be a problem for most TSers since we all know not to click on a link in an unsolicited email but apparently it is taking in a lot of people.

http://redtape.msnbc.com/2008/02/new-cyber-trick.html

[Gregg]

Shoot, I don't even click on an unsolicited e-mail. I check the box and hit "Block" then "Spam" and it goes away.

[Paddy]

Although I suppose lots of people have gotten rich by never underestimating the stupidity of fellow human beings, I fail to see just how an email from an unknown person, trying to sell you something you don't want, will look any more "legitimate" just because it has a link with http://www.google.com in it!!! Of course these shysters can be found via Google. Duh. Surely only nitwits who are already inclined to click on links in spam are going to fall for this?

[tacit]

QUOTE(Paddy @ Feb 11 2008, 03:38 PM) <{POST_SNAPBACK}>

Although I suppose lots of people have gotten rich by never underestimating the stupidity of fellow human beings, I fail to see just how an email from an unknown person, trying to sell you something you don't want, will look any more "legitimate" just because it has a link with http://www.google.com in it!!! Of course these shysters can be found via Google. Duh. Surely only nitwits who are already inclined to click on links in spam are going to fall for this?

Yes, exactly. The spammers do not do this so that their mail looks more legitimate; the spammers do this to sneak their spam past spam filters.

Many spam filters work by blocking email containing any Web address known to be used by spammers. The spammer can't put "www.myfakepenispills.com" in the email, because it will be blocked. So instead they post a Google URL, because having a Google URL in the spam email doesn't trigger the spam blocking software.

Incidentally, the article got the details wrong; the example they show is an example of Google redirection spam, not Google "I'm Feeling Lucky" spam.

[Paddy]

QUOTE

...the spammers do this to sneak their spam past spam filters.

Yes - although few of them seem to use their actual web sites in their emails anyway - they often redirect, obviously in an attempt to dodge spam filters.

I get very little spam, so rarely actually get an opportunity to even look at it. I got one recently that in light of this conversation, was quite interesting once dissected: had a link to a blogspot.com site - allegedly. When the link was clicked, it went to the blogspot site alright, but there was a blank page with a link "If site not apeared, Click here." (sic) That link then led to a site with the web address http://www.welsiook.com/ - but called "US Healthcare Inc." Sure, boys. A web site registered in China.... Complete with fake Canadian doctors, with impressive, if bogus and somewhat poorly written resumés, complete with stock photos from Getty Images.

I'd never bothered to plow through all the particulars of these sites/spam before - it's quite incredible the lengths they go to to look legit to a casual observer. The fake office building locations are pretty funny. Further dissection at Wikipedia:

http://spamtrackers.eu/wiki/index.php?titl...lth%26Care_Mall

Anyway - it's interesting that Google are quite concerned (or say they are) about spammers using google.com for redirection, but don't seem particularly concerned about spammers using blogspot/blogger for the same thing:

http://forum.spamcop.net/forums/lofiversio....php/t7949.html

They do provide the ability to report spam blogs, though I'm not sure how proactive they are about doing anything about them. I got that bit of spam 2 days ago - twice - via gmail. Am I the first person to bother reporting it? Or are they overwhelmed by this sort of thing and therefore take a while to shut these people down? I wouldn't know...

[Xairbusdriver]

QUOTE

When the link was clicked, it went to the blogspot site alright, but there was a blank page with a link "If site not apeared, Click here." (sic) That link then led to a site with the web address http://www.welsiook.com/ - but called "US Healthcare Inc."

I assume you detected this by looking at the email source not by actually clicking the link. And then pasting in the faked URL?

In other words, never click a link just to find out where it might take you. Once you've done that, some damage to your address may already have been done!