Malicious code is more likely to be hosted on local servers in the US and UK than in countries with less developed e-crime law enforcement policies, according to research from vendor Finjan.

Over 80 per cent of the malicious code detected by Finjan was obfuscated, making it virtually invisible to pattern-matching and signature-based methods used by anti-virus products.

Ninety per cent of the URL’s containing malicious code that were discovered resided on servers located in the US or UK.

'The results of this study shatter the myth that malicious code is primarily being hosted in countries where e-crime laws are less developed,' said Yuval Ben-Itzhak, chief technology officer at Finjan.

'Our research shows that malicious content is much more likely to show up on a local server than one in Asia or Eastern Europe. Unfortunately this means that the traditional location-based reputation heuristics are decreasingly effective against modern attacks.'

The research also found increasing sophistication of embedding malicious code within legitimate content (e.g., ad delivery and translation services) and less dependence on outlaw servers in unregulated countries.

Advertising is the leading category for URLs containing malicious code, representing 80 per cent of all instances. Attackers have discovered that the multiple parties involved and the complex structure of business relationships involved in online advertising make it relatively easy to inject malicious content into generally legitimate ad delivery streams.

Similarly, when analysing malicious content in terms of the URL web site categories, Finjan found that malicious code is just as likely to be accessed through legitimate web sites as through what might be considered disreputable  sites.

'The fact that malicious code is just as likely to be found in legitimate categories as in questionable categories means that security products that rely solely on URL categories to block access to malicious sites are no longer effective,' said Ben-Itzhak.