CircleID

As recently reported, spam volumes indicate spam has nearly jumped back up to its pre-McColo shutdown levels. However, Symantec's The State of Spam report has also observed that in recent days spammers are increasingly piggybacking on legitimate newsletters and using the reputation of major social networking sites to try and deliver spam messages into recipients' inboxes. "The social networking spam messages were carefully crafted to closely mimic the legitimate notification emails often distributed from social networking sites," writes Dermot Harnett, a Symantec analyst.

In its special URL investigation, the report also indicates that on average approximately 90% of all spam messages today contain some kind of a URL. Additionally, analysis of data from past recent days, according to Symantec, has shown that 68% of all URLs in spam messages had a '.com' Top-Level Domain (TLD), 18% had China's '.cn' ccTLD and 5% had a '.net'.

Additionally 71% of URLs in spam messages had no directories while 2.4% had more than six directories. "Similar to subdomains, scammers often use many directories as the spammers try to create URLs that look like legitimate URLs."

In the first week of 2009, 68% of all URLs in spam messages had a '.com' TLD, 18% had a '.cn' ccTLD which is reserved for China and 5% had a '.net' TLD. '.Ru' is the ccTLD for Russia and '.de' is ccTLD for Germany. Directories are often used to arrange or display certain files in URLs. Source: Symantec

Related Links:
The State of Spam, A Monthly Report – January 2009 Symantec Main Report, PDF
New Year Brings New Spam Attacks Dermot Harnett, Symantec Blog

Related topics: Cybercrime, Domain Names, Email, Security, Spam, Top-Level Domains