Back in the early days of the web — which is to say perhaps ten or twelve years ago — there was a popular website called Geocities. It was something like an early version of Myspace. In many ways, Geocities did a lot to popularize the idea of 'having a web page' for ordinary people. Anyone could sign up and start throwing content online. In its day, Geocities was a big deal, but it failed to evolve and duly dropped out of most people's awareness, overtaken by social sites like Myspace and Facebook, or blogging sites like Blogger and LiveJournal.

But Geocities — now called Yahoo! Geocities — never went away, and today it's enjoying a resurgence. Each day, I see hundreds of messages advertising Geocities URLs. The only problem? They're all spam sites.

In essence, Geocities is now an immense spam redirector. There are probably still many legitimate sites on Geocities but I never see those. Whenever I see a Geocities URL, it's a spam site (to such an extent that any message containing a 'geocities.com' URL now goes instantly into the spam bucket). Whatever mechanisms Yahoo! has set up to prevent spammers signing up for Geocities accounts have apparently been definitively broken.

In fairness to Geocities, it is not alone. Polish free hosting service interia.pl (and its sister interii.pl) are also currently being abused by spammers in the same way and in similar volume. So too is Yahoo! Groups (another Yahoo!-owned service), while Google's Blogspot is a perennial favorite. South American spammers in particular seem to adore imageshack.us for their inline image hosting needs. And so on.

It's also important to remember that for every email citing a URL at a free service, there are equally many — if not more — that advertise URLs at throwaway domains, registered on a five-day free pass under the domain tasting system and hosted by a botnet or a compliant Chinese hosting service. But those throwaway domains are easy to filter. Real-time URL blacklists, a powerful weapon in the war against spam, can track them automatically. Once the first spam message hits the blacklist maintainer's spamtrap, the domain it advertises can be publicly-identified as No Good. But when the spam contains a URL at Geocities, or Blogger, or Yahoo! Groups, it's not possible to make that call any more. There's a chance — a very small chance in the case of Geocities, a slightly larger one in the case of Blogger — that the message might be good. As a result, we lose the advantage of URL-based filtering.

The problem can be attacked. Most of these abused services are owned by the big search engine companies (Yahoo, Google) whose core expertise lies in sorting the wheat from the chaff. It would not be difficult for Google, for example, to conduct a quick automated scan of any newly-created Blogspot site and pick out the ones that have spammy characteristics. Any page that immediately redirects the user to another location merits an instant kill. Judicious use of spamtraps can also generate a list of suspect sites. All that would be required is a small amount of R&D, a little bit of regular maintenance, and a trivial amount of machine time. If something like Geocities is worth keeping around, then it's worth expending the small amount of effort needed to make sure that it doesn't become simply a free redirection service for spammers maintained at Yahoo!'s expense.

There are signs that the owners — as you'd expect — are already doing something like this. Currently, out of three Geocities URL's advertised by a particularly obnoxious porn spammer, one is already reporting “Esta página no está disponible”. But two more aren't, and the spamtrap is full of other messages pointing to Geocities URLs touting pharmaceuticals, fake watches, casinos and all the rest of it. Currently, the good guys are still behind on this one.