Closer look on the spam URL TLD distribution
Posted on 09 January 2009.
ICANN stipulates that all domains must be connected to a registrar, and all applications for domain names must be submitted through a registrar. Today there are hundreds of thousands of Web sites registered. The process is simple and not very costly.

However, spammers can easily register domains, and it is often hard for registrars to distinguish between spammers and legitimate organizations and Web site developers. Spammers often rotate domains in their spam messages as they feel this tactic allows them to circumvent some antispam filters that depend on pattern matching to block the spam message. On average approximately 90 percent of all spam messages today contain some kind of a URL.

A recent analysis conducted by Symantec showed that over the last 7 days 68 percent of all URLs in spam messages had a com TLD, 18 percent had a cn ccTLD which is reserved for China and 5 percent had a net TLD. Ru is the ccTLD for Russia and de is ccTLD for Germany. Spammers often rotate between TLDs to try and evade antispam filters.

Directories are often used to arrange or display certain files, and Symantec found that while 71 percent of URLs in spam messages had no directory, 2.4 percent had more than six directories. Similar to subdomains scammers often use many directories as the spammers try to create URLs that look like legitimate URLs.

Source: Symantec's "The State of Spam Monthly Report" – January 2009.


Biggest ever cyber security exercise in Europe is underway

Posted on 30 October 2014.  |  More than 200 organisations and 400 cyber-security professionals from 29 European countries are testing their readiness to counter cyber-attacks in a day-long simulation, organised by the European Network and Information Security Agency (ENISA).

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.


Fri, Oct 31st