2011-11-01
Abstract
Increase reported in spamvertized URLs using domains that are yet to be registered.
Copyright © 2011 Virus Bulletin
Commtouch has reported an increase in spamvertized URLs using domains that are yet to be registered at the time the spam is sent – making it less likely for such messages to be blocked by spam filters.
The use of domain blacklists and reputation services is common among spam filters and spammers try to avoid using domains with a bad reputations in their emails – they may use URL shortening services, for instance, or use links to compromised pages on a legitimate domain.
A less common trick is to use domains that are not yet registered – spam filters usually do not compute reputation for non-existent domains.
In such cases the domain is registered some time after the emails have been sent. Because most spam filters do their work at the moment the email is received, they will have made their decision by then. However, many users do not read their email until much later and by that time the links are expected to be active.
While this trick is not new, spammers have been using it extensively in recent weeks – another example of spammers recycling tricks from the past.
