BLOG

Spam, campaign statistics and red flag URLs

It’s not often spammers send me their campaign statistics, but on Tuesday one did.
The spam came “from” news@udemy.com, used udemy.com in the HELO and message-ids and, sure enough, was advertising udemy.com:
 

 
But the call to action link was a bit.ly URL. Following the clickthroughs, the bit.ly URL redirected to linksynergy.com, which in turn redirected to udemy.com. Nothing too surprising – udemy.com’s users are paying udemy for clicks, which udemy are buying from linksynergy and linksynergy are buying from our spammer. A perfectly normal, spammer-infested affiliate programme.
The spammer might be using bitly to hide the linksynergy URL (linksynergy links on web pages might well be legitimate, but in email they’re a serious red flag and an almost sure sign that the mail is spam), but I think it more likely they’re using it for bitly’s click-through reporting.
One of the nice things about bitly clickthrough reporting is that anyone can see it, just by adding a + sign to the end of it. Our spammer sent https://bitly.com/1JUHIe3, so if we go to https://bitly.com/1JUHIe3+ we can see everything about the clicks on it.
It’s had 56,622 clickthroughs since early February. The vast majority of clicks had no referers, so were likely from email. Of the few hundred that did have referers, they mostly look like webmail. So it’s pretty likely this URL has been used solely for spam.
Bitly__The_power_of_the_link_
 
This same URL has been used in four spam campaigns so far, mostly targeted to North America.
Bitly__The_power_of_the_link_
Bitly__The_power_of_the_link_
From a spam perspective one of the interesting things is that this URL has been in active use in spam for at least six months, without any of Udemy, LinkSynergy (aka Rakuten) or bit.ly taking any action against it. It’s possible that’s just because none of them knew about it, I guess.
If I’m filtering email this tells me that bitly (or clicksynergy or linkshare) URLs in email are likely to be a problem – and, hence, if I’m sending legitimate email I should avoid using any of that sort of URL in my email. Something we’ve discussed here before.
And if I’m considering running an affiliate programme this is a good example of why I either have to run a very good, well-policed affiliate programme or make a business decision that I’ll make more money from paying spammers to bring in leads than I’ll lose customers due to my poor reputation.

2 comments

  1. Julius says

    Wow. Today I learned that you can view Bitly’s statistics by adding + sign. #theMoreYouKnow

  2. George says

    Received a “udemy” email like this on August 12.
    Sent from a Singapore company’s Los Angeles datacenter: 202.9.68.35
    Sent to an address that was *only* used for an Adobe.com account, so they probably grabbed the address from when Adobe was hacked.
    Linked to http://goo.gl/TuRwKE+ (without the +)
    Which forwards to http://click.linksynergy.com/link?id=RyGmteFvXN4&offerid=323058.380822&type=2&murl=https%3A%2F%2Fwww.udemy.com%2Fhow-to-use-photoshop-cc-for-beginners%2F
    Also had an image that provides a viewcount: http://i.imgur.com/eEKGSrf.png

Comment:

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.