Application security

MessageLabs: Image spammers use non-registration websites to their advantage

Levels of image spam held steady last month at 15 to 20 percent of all junk mail, but phishing emails were at their highest levels this year, according to just-released research from MessageLabs.

Spammers are now hosting images on sites that do not require registration, then linking to those sites from the bodies of spam emails — instead of embedding messages within the emails themselves, according to the report.

The level of total spam captured during May decreased from the month before, dropping 3.4 percent to 72.7 percent of all email, according to MessageLabs.

Paul Wood, senior analyst at MessageLabs, told today that image spam is difficult to measure because it increases sharply over short periods of time.

"What we’ve been seeing is that it’s quite a difficult metric to capture. It varies depending on when you take the measurement. A lot of image spam will go out in text form, as well as with an image, so depending on when you take the measurement, you can get quite different results," he said. "Over a longer period, it tends to flatten out a bit. Over the last couple of months, it’s been higher, but I wouldn’t say that it’s been massively high, as we’ve seen in some reports."

Image spam levels have fluctuated widely in recent months, according to reports from various sources.

A report on April’s email-borne threats from Symantec showed a 10 percent drop in image spam from March to April, when it accounted for 27 percent of all spam.

McAfee last month reported a drastic drop in image spam, with Nick Kelly posting on the McAfee Avert Labs Blog that emails using the technique plummeted from 59 percent of all spam at the start of April to 12 percent near the end.

Last month, researchers at Fortinet said they had seen an April increase in image spam, but those statistics were still dwarfed by those from earlier this year.

MessageLabs’ latest email security report also noted an increase in "spam surges," the practice of targeting individual domains in one aggressive spam attack.

The New York-based vendor noted that one attack lasted 11 hours and sent 10,000 spam messages.

Phishing attacks rose by 0.4 percent during May, accounting for one in 156.3 emails, or 79 percent of all malicious email traffic.


Get more IT security news. Click here for SC Magazine Blogs.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.