Spammers bypass spam filters with Google Translate links

Google Translate is the latest trick in spammers’ arsenal for bypassing email spam filters, warn Barracuda Labs researchers.

Spam filters work by evaluating (among other things) the reputation and the destination of links included in emails, so spammers are attempting to bypass the filters by making the first “jump” to a instinctively trustable Google domain, and then to a poorly maintained URL shortener.

“Clicking on the link sends us to Google translate. Google translate fetches the shortened URL and follows it to playandstudy.org, a hacked wordpress-based website in France. Playandstudy.org returns Russian text that translates to “Redirected to the requested page…” and Google translate displays that on its page in an iframe,” the researchers explained.

The attack ends up with the user finally being redirected to a rogue pharmacy site.

The researchers point out that the trick does not work all the time, making them believe that Google may be implementing code that defeats “framebusting”. In any case, users are advised not to inherently trust similar links, especially when they are delivered in unsolicited emails.