Malware authors have found a way to evade URL-blocking systems by swapping bad domain names with unknown ones.