Comment Diminishing Returns (Score 3, Insightful) 84
This kind of research is almost self-defeating.
When you put out there a list of words that help flag a domain as "bad", you're just signaling to the malware makers to avoid those words.
Then you can make a new list of words. And then they'll avoid those words.
Eventually, the malware domains will be essentially indistinguishable from the real domains.
That's lose-lose for everyone.
Unfortunately, keeping the list secret does no good either. If it's truly secret, then no one can use it to fight malware. If it's only "secret" as in "not widely published", then the malware makers will still find it and use it.
There is no right choice.