I've written before about the increased use of URL shorteners in spam. For spammers, the advantage of using a URL shortening service is that the URLs in their messages aren't immediately recognizable as spam domains, and recipients may be reluctant to reject messages just because they contain a shortened URL. On the other hand, if the shortening service admins are on the ball, they can set up tools to do mass purges of spammy URLs. But they must want to address the problem ...

Our spamtraps get hit with a fair amount of unsolicited email from Latin America, particularly from Brazil, Argentina and Peru. By and large, this email is from actual businesses (albeit sometimes small or shady ones) rather than pharmacy spammers or penis pill vendors.

Some of the senders are knowingly abusive, as can be seen by the contortions they go through to try to avoid spam-filtering or identification. The word 'publicidad' ('advertising') which several Latin American spam laws require to be included in the subject line of the message, is often permuted in interesting ways. Others actually comply, to a greater or lesser degree, with whatever laws are in force in their country. And then there are the disclaimers ...

A recent piece of unsolicited email, promoting a Brazilian retailer called Chic Mix, carries the following interesting message (loosely translated from the Portuguese):

Anti-Spam Policy: if you don't want to continue receiving news from Chic Mix, please click here

If you spotted that the words 'anti-spam policy' don't really belong there, give yourself a small prize. Whatever that message is, it's not a 'policy'.

One of the perennial problems for spammers is finding what the intelligence community refers to as 'clean skins': identities that aren't associated with known bad actors. For spammers, the problem is two-fold: they want their emails to originate from netblocks that aren't known to be spam-infested, and they want the URLs that they cite to refer to domains that aren't known as spam domains.

In a blog post, Microsoft has acknowledged that some Hotmail users' accounts are being hijacked, a problem that has been previously discussed here. The article claims that a "worm or virus" is involved.

As mentioned in a recent post about abuse of URL shorteners, Yahoo! is currently a popular choice for spammers wanting to host their ads on a 'trustworthy' domain. Spammers create Yahoo! groups or profiles, post their ad copy to the profile page or as a message to the group, and then send out spam containing the relevant URLs. Because the URLs contain the 'yahoo.com' domain name, they aren't good candidates for URI DNSBL filtering.

Our traps have been picking up a lot of this kind of spam recently, so I decided to try to work out how big the problem really is.

MessageLabs is reporting that use of URL shorteners in spam has exploded, with more than 2% of all spam now containing shortened URLs. The technique is reported to be heavily used in spam sent by the Donbot botnet.