Increase in Hit & Run Spam

During the past two weeks, Symantec has observed an increase in hit & run spam activities (also known as snowshoe spam) in its Global Intelligence Network. Hit & run spam messages have the following characteristics:

  • Usually originates from IP ranges with neutral reputation
  • Uses a large IP range to dilute the amount of spam sent from each IP address
  • Contains features (such as Subject line, From line, and URLs) which change quickly
  • URL is the call-to-action
  • Often uses large quantity of “throw-away” domains in a single spam campaign

Here is a breakdown of top three products or services promoted by such spam over last week:


#1Spam Promo

#2 Spam Promo

#3 Spam Promo


Solar panels

Hair loss medication

Auto insurance


Hair loss medication

Non-stick pan

Home security system


Hair loss medication

Maid service

Auto insurance


Hair loss medication

Maid service

Auto insurance


Maid service

Pet medication

Backyard makeover


Non-stick pan

Pet medication

Cleaning product


Auto clearance

Refinance offer

Credit card offer


Life insurance

Auto warranty

Ink cartridges

In addition to above, there were also hit & run messages promoting the following products or services:

  • Auto warranty
  • Satellite TV
  • Learning new language
  • Floral products
  • Auto loan
  • Free credit reports
  • Online dating service
  • Work-at-home opportunities
  • LASIK service

The spammer uses varying subject lines to offer the same type of product or service. For example, here is a list of sample subject lines offering a hair loss product:

Subject: Finally a hair solution that works for Women
Subject: Attention Women: Get fuller hair risk free
Subject: See the latest trick for thinning hair
Subject: Try the newest solution to regrow hair. Risk Free
Subject: See how celebs get fuller thicker hair
Subject: Attention Women: See the latest trick to restore hair

In addition, some spammers insert hyphens at random locations to further increase their chances of successfully delivering the spam message.  Here is a list of sample subject lines offering home security:

Subject: [BRAND NAME REMOVED] De-aler $99 Install He-re to help Pro-tect You
Subject: [BRAND NAME REMOVED] monitored and Dea-ler installed
Subject: [BRAND NAME REMOVED] De-aler Installed se-curity sy-stem $99
Subject: [BRAND NAME REMOVED] De-aler Fr-ee Sys-tem Of-fer
Subject: [BRAND NAME REMOVED] Home Security is #1- Fr-ee Security Sy-stem!
Subject: [BRAND NAME REMOVED] is #1 This De-aler has a $99 Install
Subject: [BRAND NAME REMOVED] monitored se-curity from Top De-aler $99 install
Subject: [BRAND NAME REMOVED] can help pro-tect your home in 2012
Subject: [BRAND NAME REMOVED] Auth De-aler $99 install with Fr-ee S-ystem
Subject: [BRAND NAME REMOVED] De-aler $99 Of-fer Dont settle for le-ss

While the presence of URLs is not the only condition to make the message qualify as hit & run spam, the chart below shows the percentage of spam messages containing an URL increasing during the past week:

Symantec continues to monitor this trend and create additional filters to target these attacks. In addition, Symantec advises enterprises and consumers to also adapt best practices found in the Symantec Intelligence Report.