It is very common for malware to use recently registered addresses. They absolutely should be using it as a heuristic.
replyYeah fair, I guess I should've said they shouldn't be weighting it so strongly in the heuristic (if that's even at play in this case).
reply