Image Spam Hosted on Windows Live Spaces

It looks like the spammers using image spam are on the move again.

We've written before about spammers sending out links in emails that point to images that are being housed on free image hosting services like ImageShack and Flickr as vehicles for delivering image spam (see here and here for the original posts from May and June 2007).  Other folks have recently written about Google's Picasa image hosting service recently being abused in the same way. 

In a spin on blog spam, we've now recently started to see image spam being hosted on Windows Live Spaces, a blogging and social networking platform by Microsoft.  In this new tactic, spammers are setting up bogus Live Spaces, hosting an image in the blog section of the page, then spamming out links to the site.  So far the spam images that we have seen have had a debt consolidation flavor like this one:




Most of the spamvertised links that are pointing to these images are very obviously suspect and have the format of http://cid-[series of alpha characters].spaces.live.com (e.g. hxxp://cid-8bbc31c85ef08898.spaces.live.com/).  Current volumes of these types of emails is about 11,000 per hour.

There is no malware component associated with these campaigns that we are currently observing.  It is usually the next logical step so I wouldn't be surprised if we started seeing them soon.