Google Leaves Spammers Feeling Lucky

There's a handful of items that SpamButcher and other programs to stop spam email use to detect most spam:

Although SpamButcher doesn't, many programs now use a URL blacklist like SURBL to evaluate if a given URL is indicative of spam. The concept works almost exactly like a traditional DNS blacklist does for email servers. If a URL is known to be associated with spammers, it's pretty safe to block an email containing it.

With no surprise, spammers are learning how to adapt.

By abusing Google's "I'm Feeling Lucky" feature, they're able to produce links that don't point directly at their sites, but do trick Google into sending users where they want.

For example, if in an alternate universe, SpamButcher used spam to advertise - we could send out emails with links like the following:

http://www.google.com/search?q=spam+blocker+download&btnI=ec

While there's not a direct reference to www.spambutcher.com, clicking the link still sends users there.

Fortunately, it's pretty easy to detect when spammers are using this trick, and use it to help with stopping spam. It's fairly rare that users intentionally create this kind of link and send them to friends, so the risk of rejecting good email is low.

Back