Spammers take advantage of holidays – Report

The January report of the Symantec Intelligence has shown that spammers were using holidays and major events to make their mail more appealing.

The Symantec Corporation made this disclosure recently in a report on the findings which saw over 10,000 unique domain names compromised with a redirect script written in PHP that contains a reference to the New Year in the file name.

Also, the report had it that the redirect scripts were hosted on compromised Web sites and links to these were included in spam emails, which were subsequently blocked by Symantec.cloud. 

Senior Intelligence analyst at Symantec, Mr. Paul Woods, said that the Symantec Intelligence expected to see spammers taking advantage of other upcoming “calendar events” with one of the most important traditional Chinese New Year celebrations starting this week and continuing for several days,  as well as the just ended Valentine’s Day.  

“We also expect to see plenty of spam and malware taking advantage of some of the major upcoming sporting events this year. We are already seeing references to the Summer Olympics in London as part of 419 or advance fee fraud messages,” he said.

Mr. Woods further said that by relating their mails to widely-celebrated holidays and current events with global interest, spammers and malware authors could at first glance make their messages more interesting, and increase the chance of recipients visiting spam Web sites or becoming infected. 

Mr. Woods further disclosed that, during December, global spam levels dropped, but in January gradually returned to similar levels as in November 2011, which is still lower than the 2011 average. 

“In January 2012, the global ratio of spam in email traffic rose by 1.3 percentage points since December 2011, to 69.0 per cent (1 in 1.45 emails). This follows a more noticeable drop in December when spam fell by 2.8 percentage points to 67.7 percent. The recent increase means that spam has almost returned to the same level as in November 2011,” he said. 

Pointing out that the global phishing rate increased by 0.06 percentage points, taking the average to one in 370.0 emails (0.27 percent) that comprised some form of phishing attack.

The global ratio of email-borne viruses, he said, in email traffic was one in 295.0 emails (0.33 percent) in January, a decrease of 0.02 percentage points since December 2011. In January, 29.0 percent of email-borne malware contained links to malicious Web sites, unchanged since December 2011.

However, January also saw an average of 2,102 Web sites each day harboring malware and other potentially unwanted programs including spyware and adware; a decrease of 77.4 percent since December 2011.

He explained that the report, the most frequently blocked malware for the last month was WS.Trojan.H. This, Mr. Wood noted, is a generic cloud-based heuristic detection for files that posses characteristics of unclassified threat. Just as files detected by this heuristic are deemed by Symantec to pose a risk to users and are therefore blocked from accessing the computer.

Geographically, Saudi Arabia became the most spammed in January; with a spam rate of 75.5 percent. China was the second most-spammed with 75.0 percent of email traffic blocked as spam. In the US, 69.0 percent of email was spam and 68.7 percent in Canada. The spam level in the UK was 69.3 percent.

In The Netherlands, spam accounted for 70.7 percent of email traffic, 68.2 percent in Germany, 69.1 percent in Denmark and 68.6 percent in Australia.

The Netherlands, he said, became the country most targeted for phishing attacks in January, with one in 62.6 emails identified as phishing. The UK was the second most targeted country, with one in 179.4 emails identified as phishing attacks. Phishing levels for the US were one in 1,145 and one in 379.9 for Canada.   

Additionally, he said, the Netherlands had the highest ratio of malicious emails in January, with one in 61.4 emails identified as malicious. The UK had the second highest rate, with one in 169.1 emails identified as malicious.

While in South Africa, one in 305.9 emails were blocked as malicious, event as the virus rate for email-borne malware in the US was one in 592.5 and one in 285.4 in Canada. 

Remmy Nweke

ITREALMS Online ... delivering news for ICT4D