Closer look on the spam URL TLD distribution
Posted on 09 January 2009.
ICANN stipulates that all domains must be connected to a registrar, and all applications for domain names must be submitted through a registrar. Today there are hundreds of thousands of Web sites registered. The process is simple and not very costly.

However, spammers can easily register domains, and it is often hard for registrars to distinguish between spammers and legitimate organizations and Web site developers. Spammers often rotate domains in their spam messages as they feel this tactic allows them to circumvent some antispam filters that depend on pattern matching to block the spam message. On average approximately 90 percent of all spam messages today contain some kind of a URL.

A recent analysis conducted by Symantec showed that over the last 7 days 68 percent of all URLs in spam messages had a com TLD, 18 percent had a cn ccTLD which is reserved for China and 5 percent had a net TLD. Ru is the ccTLD for Russia and de is ccTLD for Germany. Spammers often rotate between TLDs to try and evade antispam filters.

Directories are often used to arrange or display certain files, and Symantec found that while 71 percent of URLs in spam messages had no directory, 2.4 percent had more than six directories. Similar to subdomains scammers often use many directories as the spammers try to create URLs that look like legitimate URLs.

Source: Symantec's "The State of Spam Monthly Report" – January 2009.


(IN)SECURE Magazine issue 45 released

(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Learn about personal data bankruptcy and the cost of privacy, security and compliance, delivering digital security to a mobile world, and much more.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Mar 5th