Trust That URL? Think Again.

The IBM X-Force recently released the full 2010 Trend and Risk Report, which details experience and insights gained from managing 4,000 client environments worldwide, as well as analysis of every publicly disclosed vulnerability.

One tidbit I found particularly interesting: 90 percent of spam is classified as URL spam, or messages that include URLs that a person clicks to view. This surprises me because I would think this would be the least-effective spam method; people are more cautious of emails that ask them to go to an outside website. However, the X-Force reports the majority of those domain names are well-known and trusted, such as Internet service providers, image-hosting websites and URL shortening services.

According to the report, “Not only do these legitimate websites provide a recognizable (and trustworthy) web link to the end user, but spam messages using them may also successfully evade some anti-spam technology because they only use legitimate links in their spam emails.”

It’ll definitely make me think twice before clicking a link from what I think may be a trusted site.

Of course, the X-Force report has much more significant and business-relevant findings. Get the full report online, follow the X-Force blog for further analysis or even interact with the data from the past several years. What findings do you think are most interesting?

Comments

[Valeriano Cossu]

Broken link on "full report onlin". I get this link, but not work:

http://ibmsystemsmag.blogs.com/the_buzz/2011/04/www-03.ibm.com/security/landscape.html

[Joydeep Banerjee]

I agree with the finding - have got many mails with spam URL. Often they are disguised - the text of the URL being displayed may not by the URL linked. Normally I sneak a look at the link URL (hyperlinks are usually displayed at the bottom of the email when mouse is bought on it) before clicking.

[Natalie Boike]

The link has been updated. Thanks!