Spam and phishing reports

Spam evolution: April 2009

Spam in mail traffic

The amount of spam in mail traffic averaged 82.7% in April. A low of 72.8% was recorded on 26 April, while there was a high of 88.2% on 20 April.


Percentage of spam on the Russian Internet in April 2009

The amount of graphical spam decreased by 1% and accounted for 18% of all spam.

Phishing and malicious programs

Links to phishing sites were present in 0.52% of emails, 0.02% lower than the figure for March. PayPal and eBay remain the most common phishing targets.

Organizations targeted by phishing attacks
Organizations targeted by phishing attacks

The number of emails containing malicious attachments increased by 0.17% in April and averaged 0.18%. Cybercriminals repeatedly used sites advertising erectile dysfunction medication to spead malware: links in messages advertising Viagra led to sites hosting Trojan.Script.Iframer.

The number of emails containing malicious attachments increased...

Spam by category

Breakdown of spam categories on the Russian Internet in April 2009
Breakdown of spam categories on the Russian Internet in April 2009

In April, the top five categories were:

  1. Medications, health-related goods and services – 23.1% (+6.3%)
  2. E-advertising services – 19.7 % (+0.9%)
  3. Education – 11.2% (+0.8 %)
  4. Fake designer goods – 8.5% (-0.3%)
  5. Real estate – 7.2% (+1.7%)

The amount of spam in the Medications, health-related goods and services category increased significantly in April due to English-language adverts for Viagra.

Interestingly, spammers included links to sites offering Viagra in messages advertising cold and flu remedies and other standard medications. It seems that spammers have decided to diversify their list of brands.

What if you caught virus and you need something to help you right now?
There is no time for prescription, no time for going among supermarkets and asking for the
product you need.
The key is here! Enter our site, click and you’ll get every name you need, regardless of what
the problem is (from hypertension or lupus to common flu!).
By the way, if you just compare prices on our site to the usual ones, you’ll see our full
advantage!
Remember, not only we sell goods for that prices, we ship them in a fast and professional
way!
Stay with us, say bye to illnesses!

The E-advertising services category lost the top spot in April’s rating, but this type of spam became more aggressive. Spam in this category increased in volume in comparison to March and accounted for 20% or every fifth spam message sent on the Russian Internet.

Russian-language spammers are trying to broaden their list of clients by winning over the English-language audience with short messages in English offering mass mailing services. The messages are clearly sent by Russian-language spammers because senders’ addresses are mostly hosted on the .ru domain zone and the message subjects are often in Russian.

I offer services of mass delivery of your letters on email
My prices begin from 120$
I prefer to work with partners!
Icq: NUMBER

The imminent end of the school year and the prospect of final exams saw the Education category move up to third place in the rating.

April also saw Adult content spam lose ground, with its share dropping by 8.4%, leaving it outside the top five for the first time since May 2008.

At the same time the Real estate category has re-entered the top five. The majority of messages in this category proposed that the recipient rent or buy property which is still under construction.

Spammer tricks

April’s trick of choice was to use a Mail.ru service which masks spam links in messages, making them look like a link to a free Mail.ru hosting service. In fact (which are masked with the help of html tags) lead to a web page containing adverts for occult services.

In order to distribute as many links to sites advertising Viagra as possible, spammers used another trick: messages containing intrusive medication offers were made to look as though they had been sent by Men’s Health, a well-known resource.

spamstat_aprl2009_pic06s

Conclusion

It’s quite possible that May will see the share of spam in mail traffic continue to decline as a result of the long May holidays. However, the usual clear seasonal reduction in spammer activity this year may fail to materialize. Given that the share of messages in the E-advertising services in April averaged 20% of all unsolicited messages, it’s likely that even if spammers fail to find new clients, the share of spam in mail traffic over the summer months will remain at the same level due to aggressive self-advertising. Only time will tell which of these two trends – a reduction in the number of orders, or an increase in spammer advertising – turns out to be more substantial.

  • The volume of spam in mail traffic decreased by 3.9% compared to March and averaged 82.7%
  • Graphical spam accounted for 18% of all spam.
  • Links to phishing sites were found in 0.52% of all emails – a decrease of 0.02% compared to March.
  • Malicious files were found in 0.18% of emails – an increase of 0.17% compared to the previous month.
  • Spammers used links leading to otvet.mail.ru to disguise links leading to other sites.

Spam evolution: April 2009

Your email address will not be published. Required fields are marked *

 

Reports

APT trends report Q3 2024

The report features the most significant developments relating to APT groups in Q3 2024, including hacktivist activity, new APT tools and campaigns.

BlindEagle flying high in Latin America

Kaspersky shares insights into the activity and TTPs of the BlindEagle APT, which targets organizations and individuals in Colombia, Ecuador, Chile, Panama and other Latin American countries.

Subscribe to our weekly e-mails

The hottest research right in your inbox