Skip Links

Network World

  • Social Web 
  • Email 
  • Close

U.C. researchers: Take antispam fight to the Web

By Robert McMillan , IDG News Service , 08/07/2007
Newsletter Signup
  • Share/Email
  • Tweet This
  • Comment
  • Print

Spammers may have an Achilles Heel.

According to researchers at the University of California, San Diego, antispam fighters could really hurt the spammers bottom line, if they target the Web sites used to host their scams rather than simply trying to block the mail server used to send out unsolicited commercial e-mail.

"If there was more diligence in taking down the Web sites, that would have an effect on overall spam," said Chris Fleizach, a research assistant with U.C. San Diego. "A lot of people using spam to advertise their sites aren't well provisioned," he explained, "so focusing on these bottlenecks would have a deleterious effect on the spam campaign."

Fleizach is part of a research team that recently took a close look at the network infrastructure used by spammers. They concluded that while spammers may use many different servers to send out their e-mail, it's a different story when it comes to hosting the Web page that sells the watches or male enhancement products featured in the spam.

In fact, 94 percent of the time, the scam could be traced back to a single Web server. "Most scams are hosted on a single IP address, providing a potentially convenient single point for network-based interdiction either via IP blacklisting or network filtering," the researcher wrote in a paper to be delivered Thursday at the Usenix Security 2007 conference in Boston.

That's because these Web sites are often run by gray market vendors who need to set up complex e-commerce sites, said Stephen Pao, vice president of product management with antispam vendor Barracuda Networks. "Folks who sell diet pills, folks who sell fake watches, they all need to take credit-card numbers," he said. "And they all need to have central data centers."

The U.C. researchers monitored over 1 million spam messages over a one-week period late last year, tracing them back to more than 36,000 URLs. Using a data analysis technique called image shingling, they were able to identify 2,334 distinct spam campaigns, hosted on 7,029 computers.

Previously used by search engines, image shingling can break down a screen shot of a Web page and analyze its graphical elements.

Researchers found that nearly 40% of the time the spammer's Web site was also being used by another spam campaign, suggesting that these machines are often rented out to more than one spammer.

  • Share/Email
  • Tweet This
  • Comment
  • Print
Comments (3)
Login
Forgot your account info?

In the past, blacklistingBy Anonymous on August 9, 2007, 2:14 pmIn the past, blacklisting has produced false positives, especially in cases in which mail relays have been hijacked. Some blacklisting of this type has caused significant...

Reply | Read entire comment

blue frogBy Anonymous on August 9, 2007, 10:52 amdo a google search for blue frog, http://en.wikipedia.org/wiki/Blue_Frog they tried a novel method to stop spammers by keeping a do not spam list, and filling...

Reply | Read entire comment

RE: U.C. researchers: Take antispam fight to the WebBy Link on August 9, 2007, 4:54 amThat opens up a can of worms - people could blacklisting sites of enemies or blackmail targets. Plus it does nothing against pump and dump stock schemes. Re:...

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed