Spamming and Phishing With Short URL Script

A few days ago we received an e-mail pointing us to a user of our Short URL Script.

You might want to be aware of the fact that cuturl.cn is using your link on their main page. They are sending out fraudulent emails made to look like they are from Bank of America requesting people to update account info by opening email. I have forwarded this to www.fbi.org/fraud. If you do not wish to be connected with this you may want to get your link off of their page.

Since we are running a short URL service ourself, we are familiar with that issue. Our service has been shut down twice by the webspace provider. Here is our answer to the e-mail above.

Thanks for bringing this to our attention. From our experience, the website you mentioned is not sending Spam/Fraud/Phishing e-mails itself but rather providing a short URL service. The fraudsters "only" use the short URL service to disguise the URLs to their fraudulent websites. You can read more information about this special kind of issue on surbl.org, a website dedicated to fight spam and phishing:

http://www.surbl.org/redirect.html

Additionally, hundreds of thousands of users put a link to our website on their website because they are using our tools and want to say thanks this way and send us web traffic. As you can imagine, some of these websites are a rather bad places (adult content for example) to have a link on. As much as we have tried it in the past, it is almost never possible to get a link remove because - apparently - people simply don't care.

Imagine a scam website created with Microsoft Frontpage where it says "This website was created with Microsoft Frontpage" and a link to microsoft.com. Microsoft wouldn't and couldn't do anything about that and most people wouldn't hold them liable.

My advice would be - besides forwarding the site you mentioned to the FBI - using sites like following:

http://www.surbl.org/
http://www.phishtank.com/
http://www.castlecops.com/pirt
http://www.antiphishing.org/

Those websites maintain blacklists with domains of spammers and phishers. Software vendors like us can query those lists and reject such domains from sending e-mails or using our tools (like the short URL tool you mentioned above).