Posted on behalf of Dan Bleaken, Malware Data Analyst, Symantec Hosted Services

The Haiti earthquake happened at 21.53 GMT on Tues Jan 12.  It wasn’t long before we saw something related in spam, about 24 hours in fact. 

Spammers, almost without fail, produce spam campaigns containing text relating to virtually every major newsworthy event that is going on.  And also plenty of events that are in the news, that are not particularly global or exciting or even interesting sometimes.   The approaches that spammers frequently use when newsworthy events arise include:

1.    Spammers may just continue to send the same old spam campaigns, Pharmaceuticals, fertility drugs, watches or whatever.  But, if they include the latest news headlines in the subject or somewhere in the body, this works to grab the attention of the recipients and make it more likely they will open the spam and get drawn into whatever the...

Posted on behalf of Mathew Nisbet, Malware Data Analyst, Symantec Hosted Services

People all over the world are currently feeling a great deal of sympathy for the people of Haiti, who were recently hit by a severe earthquake. Humanitarian aid is being offered by many countries around the globe, and aid charities are looking for donations so that they can send all the help they can.
 
And then there are people who don’t want to help and will use any means to try and get those donations. '419' advance fee fraud scams are common and the perpetrators are always looking for new attention-grabbing topics which will trick people into handing over their money. Something like the humanitarian crisis of the Haiti earthquake is, sadly, a prime target for these scammers. They count on the public’s good nature, concern, and desire to help, and hope that they won’t see through the scam email which they are reading. The desire to help...

Posted on behalf of Dan Bleaken, Malware Data Analyst, Symantec Hosted Services

Globally, for the past month, spam accounts for roughly 75 percent of all email in circulation. And about 75 percent of that spam is sent from one of the ten to 20 heavyweight botnets, which are huge networks of infected PCs, in some cases more than 1 million strong, sending spam 24/7.  The remaining 25 percent of spam is sent via some other technique such as

•    spam sent manually/automatically in large volumes using possibly thousands of newly generated, automatic CAPTCHA-broken, free webmail accounts

•    spam sent manually/automatically using a compromised private webmail account e.g. a company webmail, university webmail etc

•    spam sent manually/automatically using servers with a weak SMTP AUTH password, which the spammers have guessed

•    spam sent manually/automatically...

Posted on behalf of Dan Bleaken, Malware Data Analyst, Symantec Hosted Services

Symantec Hosted Web Security Service blocks millions of web requests every day to protect employees from content that is either against company policy, or malicious.  In a typical week Messagelabs Intelligence performs 50 million blocks on 10 million distinct URLs for several thousand clients.  That’s tens of thousands of blocks per client per week.  

99.95% of blocked URLs are policy based. Of these, by far the greatest proportion is for advertising, mostly pop-up ads or auto-forwarding to ads.  Also, Messagelabs Intelligence blocks sites related to Games, Chat, Personals & Dating, Adult/Sexually Explicit material, Violence, Tasteless & Offensive material, Weapons, Criminal Activity, Gambling, Illegal Drugs and so on.  Clients have full control over what they consider to be against company policy.  Each day, roughly 39% of clients have...