New Trend in Spam: Island-Hopping

Anti-spam researchers with McAfee, Inc. today announced they have been tracking a new trend nicknamed "spam island-hopping," in which island-hopping spammers use the domain names of small islands as Web site links in spam campaigns to disguise themselves from spam filters that traditionally catch more well-known domains. McAfee traced spam activity from the Isle of Man to the tiny tropical island of Tokelau in the South Pacific.

Traditionally, spammers have used well-known top level domains (TLDs) such as .com, .biz or .info. By using top level domains from small island countries, such as .im from the Isle of Man, spammers attempt to avoid detection by using domains previously unknown to spam filters. Using a lesser- known top level domain makes it harder to distinguish spam from legitimate e-mail by examining the links in the e-mails.

This trend was first discovered when researchers noticed a significant increase in the use of .st domains, which is the top level domain for Sao Tome and Principe, a pair of small islands off the west coast of Africa. This unusual activity raised a flag for researchers, who then tracked the spammers on a virtual migration around the globe. Subsequently, spam using top level domains from small islands has continued to increase.

The following small islands have been identified as being favored by spammers:

TLD	Country	Land Area (sq. km)	Population
.tk	Tokelau	10	1,392
.cc	Cocos (Keeling) Islands	14	628
.tv	Tuvalu	26	11,810
.as	American Samoa	199	57,794
.im	Isle of Man	572	75,550
.to	Tonga	748	114,689
.st	Sao Tome and Principe	1,001	193,413

* Islands listed in order of land area

"This new trend is another example of spammers' relentless quest to spread their abuse of Internet domains far and wide," said Guy Roberts, senior development manager, McAfee Anti-Spam Research & Development Team. "Some of these islands have dozens of spammed domains per square mile."