The Words That Indicate Malicious Domain URLs

An anonymous reader writes: Researchers from AT&T have released research which improves the identification-rate of malicious URLs — such as those used for C&C servers or to distribute malware to redirected victims — by individuating words in the domain names. Though many of the words that Wei Wang and Kenneth Shirley were able to group as 'malign' are predictable, there is a strange recurrence of basketball-related words in the URL lexicon of malice, with 'bad' domains using names such as LeBron James, Kobe Bryant and Michael Jordan. By contrast 'golf' is least likely to be seen in a dangerous URL, along with state names, scenery and realty.

Comments

Re:Clearly the solution is to ban basketball.

[rudy_wayne]

By contrast 'golf' is least likely to be seen in a dangerous URL

I don't know about "dangerous" but I get lots of spam for golf clubs. Seriously. I have never played golf and dislike anyone who does. It originates from constantly changing URLs that all contain "golf" in some way or another. So now I just block everything containing the word golf.