Spammers Moving To Disposable Domains 147
Trailrunner7 writes "Spammers and the botnet operators they're allied with are continuing to adapt their techniques to evade security technologies, and now are using what amount to disposable domains for their activities. A new report shows that the spammers are buying dozens of domains at a time and moving from one to another as often as several times a day to prevent shutdowns. New research shows that the amount of time that a spammer uses a given domain is basically a day or less. The company looked at 60 days worth of data from their customers and found that more than 70 percent of the domains used by spammers are active for a day or less."
This is news??? (Score:4, Informative)
They've been doing this since 1999 from my personal memory aiding the antispam fight. What suddenly brings this back to the fore as if it were some stunning revelation? It's an old trick that Alan Ralsky used when he was scamming and spamming.
Re:so a new rule for email filtering? (Score:5, Informative)
This is the way our reputation provider works: If the IP hasn't been seen delivering email before (no matter it's age), it has a 0 reputation. The more email that is processed the higher the reputation and the reputation is, of course, modified down by complaints. The more complaints,the lower the reputation. Think feedback loop, or where your email goes when you click "mark as junk."
If someone else wanted to get into the game, services like spamcop could be used (who knows, maybe can already be used?) to determine domain name reputation by keeping an independent database of domain names and keeping the ratio of good to bad email handy for rapid lookups, maybe in something like dnsrbld type lookup table. It's the same as IP reputation engines, just with text domain names.
Maybe someone alread does. I know our antispam provider keeps a level of spaminess for domain names, but those are for domains that already exist. You would have to determine by policy what to do with domains that don't have a reputation.
That and implementing tighter SPF and DKIM will help eliminate this stuff.
Hey Timothy, Welcome to 1999 (Score:2, Informative)
Really ... spammers are moving to disposable domains ...
All those fja3lgah12.com email addresses I've been seeing for the last 10 or so years have been bots on real domains then eh?
Seriously Tim, if you think something is new and exciting then you are experiencing one of two things, either its not really old and its actually common knowledge to everyone BUT you and the website your viewing ... or ... the website you're viewing is wrong.
Think that EVERY TIME you go to post stories to the front page and we'll do a lot better. I'll make it simplier, just based on your history as an editor ... when you think a story is good to post, you're wrong.