As spam evolves, so do spam filters. IronPort Systems is now rating Web links in email to better filter out junk messages, including those with links to malicious sites.
The seller of anti-spam appliances on Monday announced the IronPort Web Reputation technology. The new technology looks at about 45 attributes of Web sites linked in an email message to assess whether a message might be spam, the company said in a statement.
The new technology is in response to new tactics used by spammers, said Patrick Peterson, vice-president of technology at IronPort. "Historically spam filters have looked at content. Now spammers are removing all the meaningful content and often times they will just have a link," he said in an interview.
Additionally, there are increasingly sophisticated attacks that use email and are targeted at specific users instead of a mass mail, Peterson said. "These are clever, dangerous attacks that include a link and trick the user into clicking through to a potentially malicious Web site that attacks you through your browser."
Existing anti-spam technologies were not designed to handle these targeted attacks that often deliver malicious software to a victim's computer, Peterson said.
IronPort's Web Reputation technology does a number of checks on the Web links included in an email and gives the links a score. That number, along with other checks such as sender reputation and content of the email, will determine whether an email can pass through or be blocked, Peterson said.
The checks done to determine the reputation of a Web link include when the domain was registered, where the Web site is hosted [both geographically and at which hosting provider], which DNS server it uses and how many times it has been linked in email, Peterson said.
These checks can catch a spammer because they tend to use recently registered domain names and often reuse DNS servers as well as hosting locations for their sites, among other things, Peterson said.
Attaching a reputation to Web links is a step beyond determining the reputation of an email sender, which some vendors are billing as the next big thing in email security. Makers of spam-fighting tools collect data on email senders and use that to assign "reputations" to email sending computers and Internet domains. Those who send a lot of spam get a negative rating and their messages are more likely to be filtered out.
IronPort's Web Reputation technology is part of IronPort Anti-Spam and available to customers worldwide without any upgrades. Pricing for IronPort appliances starts at $3,000 for 100 users.
