Spam Reaches All-Time High of 95% of All Email

Commtouch® has released its Email Threats Trend Report for the third quarter of 2007, based on the automated analysis of billions of email messages weekly. The report examines the appearance of new kinds of attachment spam such as PDF spam and Excel spam together with the decline of image spam, as well as the growing threat of innocent appearing spam containing links to malicious web sites.

Highlights of the report include:

Global spam levels reached an all-time high of 95% of all emails at its peak during the quarter.

Blended threat messages -- or spam messages with links to malicious URLs -- accounted for up to 8% of all global email traffic during the peaks of various attacks during the quarter.

One massive outbreak mid-quarter utilized over 11,000 dynamic zombie IP addresses to host malicious web sites. Leading zombie locations included the United States (36%) and Russia (8%).
Image spam declined to a level of less than 5% of all spam, down from 30% in the first quarter of 2007; also, image pump-and-dump spam has all but disappeared, with pornographic images taking its place.

PDF Spam represented 10-15% of all spam in early July and then dropped significantly, however a steady stream of PDF spam is still being maintained at 3-5% of all spam messages.

Pharmaceuticals and sexual enhancers were the most popular spam topics, at 30% and 23%, respectively.

Blended Threats: Spam with Malware Hyperlinks Inside

One technique which reached a new high during the quarter was innocent-appearing spam messages that contained hyperlinks to malware-sites. This type of spam utilizes vast zombie botnets to launch ‘drive-by downloads’ and evade detection by most anti-virus engines.

Several blended spam attacks of this type focused on leisure-time activities, such as sports and video games. Messages invited consumers to download "fun" software such as NFL game-tracking and video games from what appeared to be legitimate websites. Instead, consumers voluntarily downloaded malware onto their computers.

"Blended spam demonstrates the ingenuity of spammers to attempt to evade detection," said Amir Lev, Commtouch President and CTO. "Most anti-virus and anti-spam technologies are not capable of blocking these types of messages, so the malware threats are allowed to penetrate the users’ computers."

New Spam Tricks

Spammers experimented with several new techniques to slip past anti-spam engines and into inboxes throughout the quarter. For example, they disguised messages in PDF, Excel, and other popular file formats. This simple trick fools many anti-spam technologies and end users alike, whose guards may be down when they see the popular file attachment ending.

"Spammers and malware distributors are the ultimate in test marketers," Lev continued. "They keep trying different techniques to bypass spam filters and ensure that their messages have high response rates. In the future, I expect to see other file formats such as Word and Powerpoint used for a similar purpose."

More details, including samples of PDF spam and spam messages containing malware, are presented in the Commtouch Q3 2007 Email Threats Trends Report, available from Commtouch Labs at: http://www.commtouch.com/downloads/Commtouch_2007_Q3_Email_Threats.pdf