Image spam had its heyday in 2006 and 2007. In the winter of 2006/2007, more than 40 percent of all spams contained an image attachment. However, by the summer of 2007, the game seemed to be over and image spam threats stopped almost completely. There were only two short comebacks:

• In the autumn of 2008, the percentage of spam containing image attachments reached 13.5 percent at the beginning of October (measured on a weekly basis).
• By the end of April, 2009, image-based spam accounted for 13 percent of all spams (when checking weekly time intervals).

This was the last time the percentage of image spam exceeded 10 percent. From time to time we have seen some image spam threats, but none of them exceeded 10 percent (when looking at weekly intervals).

Nearly five years later, in December 2013, image spam has made a comeback! On December 5, spammers surprised us with a large amount of image spam. This new attack of image-based spam continued until December 16, as they sent out their image afflicted attempts nearly every day. For a short while they took a break but then started a massive image spam attack on December 23.

Figure 1: Percentage of Image Spam – December 1, 2013, until January 7, 2014

Details on These Recent Attacks

Some technical details discerned during these recent attacks:

• All of these spams are advertising for medical products.
• We have observed some differences in how attackers use image spam from when the technique first gained popularity around 2006-2007 to present. Originally, attackers seemed to be more careful about avoiding spam filter detection by slightly randomizing the images. Since many spam filters will use a file hash to determine if an attachment has been associated with spam activity, attackers at that time made a base image seen like a different file by using slight variations such as changing the colors or a few pixels. But today in the recent attacks, images do not change very often. Spammers use the binary identical image again and again. An image in this context was used for six days on average.
• When clicking on the images within the email letters, one is directed to a website, most often to a website <random letters>doctor.ru or to <random letters>medic.ru. Again, these URLs did not change that often. A domain was used for 3.7 days on average. This is very surprising because we normally see spam threats where spammers will use URLs only for a few hours or sometimes only for a few minutes before taking them down or changing.
• Below the image within the email spam, they have placed a lot of random text, in many cases from Wikipedia articles. The text is hard to read because it is very faint with white background. Typically, this text is used to obfuscate spam content filters like Bayesian filters.

So to summarize, technically these spams are not using new technique. The usage of image variations and time span for maintaining the Spam URLs is actually very “old-fashioned”. We are not sure why spammers would use these older techniques but perhaps after a five year absence, they are assuming that spam filters are not prepared for these large attacks of image-based spam.

It will be interesting to see whether 2014 is the comeback year for image-based spam.