Symantec is observing an increase in spam containing URLs. On May 16, URL spam volume increased by 12% from 84% to 96% and since then the URL spam volume fluctuated between 95% and 99%. That means 95% of the spam messages delivered during this period has one or more URLs in it.
Figure 1. URL spam message volume
During this period, .ru was the most used top-level domain (TLD). As illustrated in Figure 2, it is interesting to note a drop in .ru spam and a simultaneous rise in .com and .pw spam. Over 73% of the URL spam contained the .ru, .com, or .pw TLDs.
Figure 2. Top 3 TLDs distribution (last seven days)
Table 1. Spam volume of top 5 TLDs that contributed to total URL spam
We are observing an increasing use of shortened URLs and free Web domains with the .ru TLD. The spam examples seen are mainly hit-and-run (a.k.a. snowshoe) spam. The call to action URL in the spam message leads to fake offers or online pharmacy stores.
Below are the Subject lines that may be seen in spam emails.
- Subject: Ends Today! Buy One, Get One Free
- Subject: 48 Hours Only | Free Shipping!
- Subject: FREE LIFETIME PASS - WHENEVER YOU WANT
- Subject: Are you dreaming about good health?
- Subject: Satisfy your girl fully
- Subject: Win your lady's addiction
- Subject: Present your women real care
- Subject: You need Ukrainian woman with beautiful eyes that are ready to talk to private theme?
Figure 3. URL spam message
This sudden rise in URL spam volume was seen in December 2012 and January this year when holiday season spam and year-end spam was on the rise. Symantec will continue to monitor this uptick in spam containing URLs and will keep our customers protected with additional filters to block these attacks.