@article {18494,
	title = {Dynamics of online scam hosting infrastructure},
	journal = {Passive and Active Network Measurement},
	year = {2009},
	month = {2009///},
	pages = {219 - 228},
	abstract = {This paper studies the dynamics of scam hosting infrastructure, with an emphasis on the role of fast-flux service networks. By monitoring changes in DNS records of over 350 distinct spam-advertised domains collected from URLs in 115,000 spam emails received at a large spam sinkhole, we measure the rates and locations of remapping DNS records, and the rates at which {\textquotedblleft}fresh{\textquotedblright} IP addresses are used. We find that, unlike the short-lived nature of the scams themselves, the infrastructure that hosts these scams has relatively persistent features that may ultimately assist detection.},
	doi = {10.1007/978-3-642-00975-4_22},
	author = {Konte,M. and Feamster, Nick and Jung,J.}
}
