.hk domain popular for hosting sites from spammers

MX Lab noticed an increase of the usage of .hk domain in spams for software, online drug stores, replica watches,… during the last few weeks. Our intent analysis technology is intercepting a vast amount of .hk domains, about a 60% of all URLs.

One other thing that MX Lab could detect was the usage of images in the background of the image based spam. Normally, image based spam contains an integrated image in the body of the HTML part of the email. The image itself now is integrated in the HTML body tag as a background. So far, this seemed to be a one time action but it is obvious that spammers are trying to avoid detection of their images in the spam emails.