However, spammers can easily register domains, and it is often hard for registrars to distinguish between spammers and legitimate organizations and Web site developers. Spammers often rotate domains in their spam messages as they feel this tactic allows them to circumvent some antispam filters that depend on pattern matching to block the spam message. On average approximately 90 percent of all spam messages today contain some kind of a URL.
A recent analysis conducted by Symantec showed that over the last 7 days 68 percent of all URLs in spam messages had a com TLD, 18 percent had a cn ccTLD which is reserved for China and 5 percent had a net TLD. Ru is the ccTLD for Russia and de is ccTLD for Germany. Spammers often rotate between TLDs to try and evade antispam filters.
Directories are often used to arrange or display certain files, and Symantec found that while 71 percent of URLs in spam messages had no directory, 2.4 percent had more than six directories. Similar to subdomains scammers often use many directories as the spammers try to create URLs that look like legitimate URLs.
Source: Symantec's "The State of Spam Monthly Report" – January 2009.