Spammers Moving To Disposable Domains

Trailrunner7 writes "Spammers and the botnet operators they're allied with are continuing to adapt their techniques to evade security technologies, and now are using what amount to disposable domains for their activities. A new report shows that the spammers are buying dozens of domains at a time and moving from one to another as often as several times a day to prevent shutdowns. New research shows that the amount of time that a spammer uses a given domain is basically a day or less. The company looked at 60 days worth of data from their customers and found that more than 70 percent of the domains used by spammers are active for a day or less."

Comments

so a new rule for email filtering?

[TravisHein]

in addition to a commonly accepted practice of doing a reverse domain name lookup on who is sending you email, where by rejecting email from bogus domains, no domain, to now also have the mail server also do a whois lookup, and arbitrarily reject email from a domain that has been registered less than a few days ago?

Re:so a new rule for email filtering?

[fifedrum]

there are email reputation providers out there who can tell you things like that. It may even be free (it is for us anyway)

Validate domain ownership

[Animats]

When you buy a domain, you should be mailed a letter with an activation code, sent to the registrant address. No valid mailing address, no domain activation.

I don't understand spam folders

[XanC]

This is why spam folders should be Considered Harmful. Effectively, it's a delivery failure without a notice. You should either accept mail or reject it, not pretend to accept it and then stash it someplace where nobody reads it.

Using a spam folder treats outright, obvious spam with more courtesy than the borderline stuff.

Re:Good, it's costing them money

[socz]

You hit the nail on the head! Domains in bulk are a lot cheaper. I'm getting a decent deal with about 8-10 domains, but I know it could be better if I had more! So they're probably buying them up in 100's at a time (I would!).

But, what I suspect could be happening, is that they're actually working with a top level registrar who can get them at the cheapest price possible and probably gets a % back of what the spammer makes. Just a thought.