Spammers exploiting internationalised domain names

Security experts are warning that spammers are taking advantage of internationalised domain names (IDNs) owing to their increasing availability and low cost.

IDNs allow domain names to be written in non-Latin characters such as Arabic, Cyrillic and Chinese.

The introduction of IDNs has been a long-running project for internet oversight body Icann, and is now reaching the implementation stage with top level domains such as .рф for Russia.

However, Symantec.cloud's MessageLabs Intelligence team warned that spammers are using IDN registered domains in order to redirect people clicking on links within emails to spam sites.

Senior MessageLabs software engineer Nick Johnston highlighted a recently discovered German spam email promoting erectile dysfunction drugs that includes links to a popular URL shortening site.

"A recipient clicking on one of these links is first redirected to a site with a Cyrillic domain name. This shows a 'landing page' for one second, and then redirects to a site claiming to be a Swiss pharmacy," he said in a blog post.

However, Johnston added that the recipients are not likely to be aware that they are travelling via an IDN unless they watch their address bar very carefully while the landing page is being shown.

"MessageLabs Intelligence expects the use of IDNs in spam to increase in the coming months, especially as it may be easier to find unregistered IDN domains, " he said.

"Some registrars are likely to encourage wider adoption of IDNs and are expected to offer some registries at low prices, as we've seen with the introduction of other new top-level domains in previous years."