Dynamics of Online Scam Hosting Infrastructure

  • Maria Konte
  • Nick Feamster
  • Jaeyeon Jung
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5448)


This paper studies the dynamics of scam hosting infrastructure, with an emphasis on the role of fast-flux service networks. By monitoring changes in DNS records of over 350 distinct spam-advertised domains collected from URLs in 115,000 spam emails received at a large spam sinkhole, we measure the rates and locations of remapping DNS records, and the rates at which “fresh” IP addresses are used. We find that, unlike the short-lived nature of the scams themselves, the infrastructure that hosts these scams has relatively persistent features that may ultimately assist detection.


Content Distribution Network Spam Email Spam Message Spam Campaign Flux Domain 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Alexa. Alexa the Web Information Company (2008),
  2. 2.
    Anderson, D.S., Fleizach, C., Savage, S., Voelker, G.M.: Spamscatter: Characterizing Internet Scam Hosting Infrastructure. In: USENIX Security Symposium (August 2007)Google Scholar
  3. 3.
    Dagon, D., Zou, C., Lee, W.: Modeling Botnet Propagation Using Time Zones. In: The 13th Annual Network and Distributed System Security Symposium (NDSS 2006), San Diego, CA (February 2006)Google Scholar
  4. 4.
    Holz, T., Corecki, C., Rieck, K., Freiling, F.C.: Measuring and Detecting Fast-Flux Service Networks. In: NDSS (February 2008)Google Scholar
  5. 5.
    ICANN Security and Stability Advisory Committee. SSAC Advisory on Fast Flux Hosting and DNS (March 2008),
  6. 6.
    Jung, J., Sit, E.: An Empirical Study of Spam Traffic and the Use of DNS Black Lists. In: Internet Measurement Conference, Taormina, Italy (October 2004)Google Scholar
  7. 7.
    Konte, M., Feamster, N., Jung, J.: Fast Flux Service Networks: Dynamics and Roles in Online Scam Hosting Infrastructure. Technical Report GT-CS-08-07 (September 2008),
  8. 8.
    Passerini, E., Paleari, R., Martignoni, L., Bruschi, D.: FluXOR: detecting and monitoring fast-flux service networks. In: Zamboni, D. (ed.) DIMVA 2008. LNCS, vol. 5137, pp. 186–206. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  9. 9.
    Pathak, A., Hu, Y.C., Mao, Z.M.: Peeking into Spammer Behavior from a Unique Vantage Point. In: First USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), San Francisco, CA (April 2008)Google Scholar
  10. 10.
    Rajab, M., Zarfoss, J., Monrose, F., Terzis, A.: A Multifaceted Approach to Understanding the Botnet Phenomenon. In: ACM SIGCOMM/USENIX Internet Measurement Conference, Brazil (October 2006)Google Scholar
  11. 11.
    Ramachandran, A., Feamster, N.: Understanding the Network-Level Behavior of Spammers. In: SIGCOMM (September 2006)Google Scholar
  12. 12.
  13. 13.
    The Honeynet Project. Know Your Enemy: Fast-Flux Service Networks (July 2007),
  14. 14.
    Xie, Y., Yu, F., Achan, K., Gillum, E., Goldszmidt, M., Wobber, T.: How dynamic are IP addresses? In: ACM SIGCOMM, Kyoto, Japan (August 2007)Google Scholar
  15. 15.
    Zdrnja, B., Brownlee, N., Wessels, D.: Passive monitoring of DNS anomalies. In: Hämmerli, B.M., Sommer, R. (eds.) DIMVA 2007. LNCS, vol. 4579, pp. 129–139. Springer, Heidelberg (2007)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Maria Konte
    • 1
  • Nick Feamster
    • 1
  • Jaeyeon Jung
    • 2
  1. 1.Georgia Institute of TechnologyUSA
  2. 2.Intel ResearchUSA

Personalised recommendations