Measurement Study of the Web Through a Spam Lens

Spam messages are capable of carrying links to disconnected portions of the Internet. This paper looks the web as it is visible through URLs embedded in spam. We perform a study of spam using three sources: a spam honeypot, a group of high-spam student inboxes and a newsgroup devoted to posting spam messages. Our results show that 96% of spam links point to sites not reacheable by crawlers and that most of these sites are not reviewed for safety by security companies. We show that some of these contain sophisticated exploits and argue that security companies need to include URLs found in spam in their analysis.