Comment by charcircuit

It is very common for malware to use recently registered addresses. They absolutely should be using it as a heuristic.