Spammers may have an Achilles Heel.
Other stories on this topic
NETWORK RESEARCH
From the labs
10 research projects, from 'active cookies' to faster wireless.
15 more
From quantum cryptography to the air guitar shirt.
The Alpha Doggs blog
For real-time research updates.
According to researchers at the University of California, San Diego, antispam fighters could really hurt the spammers bottom
line, if they target the Web sites used to host their scams rather than simply trying to block the mail server used to send
out unsolicited commercial e-mail.
Read the latest WhitePaper - IP Surveillance - The Next Generation Security Camera Application
"If there was more diligence in taking down the Web sites, that would have an effect on overall spam," said Chris Fleizach,
a research assistant with U.C. San Diego. "A lot of people using spam to advertise their sites aren't well provisioned," he
explained, "so focusing on these bottlenecks would have a deleterious effect on the spam campaign."
Fleizach is part of a research team that recently took a close look at the network infrastructure used by spammers. They concluded
that while spammers may use many different servers to send out their e-mail, it's a different story when it comes to hosting
the Web page that sells the watches or male enhancement products featured in the spam.
In fact, 94 percent of the time, the scam could be traced back to a single Web server. "Most scams are hosted on a single
IP address, providing a potentially convenient single point for network-based interdiction either via IP blacklisting or network
filtering," the researcher wrote in a paper to be delivered Thursday at the Usenix Security 2007 conference in Boston.
That's because these Web sites are often run by gray market vendors who need to set up complex e-commerce sites, said Stephen
Pao, vice president of product management with antispam vendor Barracuda Networks. "Folks who sell diet pills, folks who sell
fake watches, they all need to take credit-card numbers," he said. "And they all need to have central data centers."
The U.C. researchers monitored over 1 million spam messages over a one-week period late last year, tracing them back to more
than 36,000 URLs. Using a data analysis technique called image shingling, they were able to identify 2,334 distinct spam campaigns,
hosted on 7,029 computers.
The IDG News Service is a Network World affiliate.
