IronPort to rate Web links in spam fight
Web reputation scoring added to catch more unwanted e-mail messages, including those with links to malicious Web sites.
The San Bruno, Calif.-based seller of antispam appliances on Monday announced the IronPort Web Reputation technology. The new technology looks at about 45 attributes of Web sites linked in an e-mail message to assess whether a message might be spam, the company said in a statement.
The new technology comes in response to new tactics used by spammers, said Patrick Peterson, vice president of technology at IronPort. "Historically, spam filters have looked at content. Now spammers are removing all the meaningful content and often times they will just have a link," he said in an interview.
Additionally, there are increasingly sophisticated attacks that use e-mail and are targeted at specific users instead of a mass mail, Peterson said. "These are clever, dangerous attacks that include a link and trick the user into clicking through to a potentially malicious Web site that attacks you through your browser."
Existing antispam technologies were not designed to handle these targeted attacks that often deliver malicious software to a victim's computer, Peterson said. Traditional systems typically scan the content of a message--looking for get-rich-quick schemes, offers for sexual stimulants and ads for porn sites, for example.
IronPort's Web Reputation technology does a number of checks on the Web links included in an e-mail and gives the links a score. That number, along with other checks such as sender reputation and content of the e-mail, will determine whether an e-mail can pass through or be blocked, Peterson said.
The checks done to determine the reputation of a Web link include when the domain was registered, where the Web site is hosted (both geographically and at which hosting provider), which Domain Name Server it uses and how many times it has been linked in e-mail, Peterson said.
These checks can catch a spammer because they tend to use recently registered domain names and often reuse DNS servers as well as hosting locations for their sites, among other things, Peterson said.
Attaching a reputation to Web links is a step beyond determining the reputation of an e-mail sender, which some vendors are billing as the next big thing in e-mail security. Makers of spam-fighting tools collect data on e-mail senders and use that to assign "reputations" to e-mail sending computers and Internet domains. Those who send a lot of spam get a negative rating, and their messages are more likely to be filtered out.
The Web Reputation technology is part of IronPort Anti-Spam and is available to customers worldwide without any upgrades. Pricing for IronPort appliances, which compete with products from companies such as CipherTrust and Symantec, starts at $3,000 for 100 users.