Most abused TLDs

The trend we observed in the last months when the non “classical” TLD increased massively continued in December as well. Contrary to November, where the .com has seen a slight increase, we are noticing this month that it decreased by more than 76%. The measures taken in November and December by the registrars of .org and .net finally show results: The usage of these two domains decreases, this month with an astonishing 151% for .org.

Spam category statistics

The spam levels decreased slightly from November, but still a lot of mixed spam has been sent. The “Others” category means all kind of spams which can’t be automatically sorted in one of the categories below. This was also expected, considering that we’ve had the holiday season where a lot of things were advertised for selling.

Extension statistics for malware URLs

As expected, the level of malware dropped significantly this month because of the fact that the spammers sent out more commercial driven messages than normal.
We are, however, seeing in January a comeback of the spam advertising malware. Interestingly, we see for the second month a significant increase of the .gif extension.

Most phished brands statistics

The most attacked brand is – as usual – PayPal. Strangely, despite the fact that we see a lot of PayPal phishing emails, we received a lot less phishing overall than in the previous months. I think that the reason for this has to do with the fact that the attacks are becoming more targeted than before. So, the phishers are improving the quality of the spam campaigns now and no longer try to flood the mailboxes blindly. This is why we see that many smaller brands (category Others) increasingly started to get phished for the second month in a row.

URL Shorteners used in malicious activities

The URL shorteners are used in emails to hide the final location of a malware file. It is not surprising to see the same trend here as in the distribution of the malware extensions (see above) because of this. The most used shorteners, bit.ly and goo.gl, have seen significant decrease in December.

Sorin Mustaca
Data Security Expert