{"id":"https://openalex.org/W7225752749","doi":"https://doi.org/10.5281/zenodo.24098122","title":"How Fast Do DNS Filters Block Fresh Phishing? A Seven-Day, Three-Vantage Comparison of Quad9, Cloudflare 1.1.1.2, and Public Blocklists","display_name":"How Fast Do DNS Filters Block Fresh Phishing? A Seven-Day, Three-Vantage Comparison of Quad9, Cloudflare 1.1.1.2, and Public Blocklists","publication_year":2026,"publication_date":"2026-11-10","ids":{"openalex":"https://openalex.org/W7225752749","doi":"https://doi.org/10.5281/zenodo.24098122"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.24098122","doi":"https://doi.org/10.5281/zenodo.24098122","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098122","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.24098122","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5153540873","display_name":"Abhijeet Apsunde","orcid":"https://orcid.org/0009-0004-6618-7450","observed_orcids":["https://orcid.org/0009-0004-6618-7450"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Apsunde, Abhijeet","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0004-6618-7450","affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5153540873"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[],"concepts":[{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.659600019454956},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.6568999886512756},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6269000172615051},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5745999813079834},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.49729999899864197},{"id":"https://openalex.org/C2778037673","wikidata":"https://www.wikidata.org/wiki/Q4034536","display_name":"Atlanta","level":3,"score":0.45989999175071716},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4571000039577484},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.4528000056743622},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.41190001368522644},{"id":"https://openalex.org/C147224247","wikidata":"https://www.wikidata.org/wiki/Q885373","display_name":"Bloom filter","level":2,"score":0.39820000529289246},{"id":"https://openalex.org/C198531522","wikidata":"https://www.wikidata.org/wiki/Q485146","display_name":"Sample (material)","level":2,"score":0.33329999446868896},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.33320000767707825},{"id":"https://openalex.org/C2776540713","wikidata":"https://www.wikidata.org/wiki/Q7800647","display_name":"Ticket","level":2,"score":0.3303000032901764},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.31769999861717224},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3009999990463257},{"id":"https://openalex.org/C2988987868","wikidata":"https://www.wikidata.org/wiki/Q32635","display_name":"Domain name","level":3,"score":0.2980000078678131},{"id":"https://openalex.org/C146778888","wikidata":"https://www.wikidata.org/wiki/Q836862","display_name":"Installation","level":2,"score":0.29350000619888306},{"id":"https://openalex.org/C512654426","wikidata":"https://www.wikidata.org/wiki/Q19652","display_name":"Public domain","level":2,"score":0.29179999232292175},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.2847999930381775},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.28040000796318054},{"id":"https://openalex.org/C2985371682","wikidata":"https://www.wikidata.org/wiki/Q11135","display_name":"Ip address","level":2,"score":0.27799999713897705},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.27559998631477356},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.2605000138282776},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.25130000710487366}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.5281/zenodo.24098122","doi":"https://doi.org/10.5281/zenodo.24098122","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098122","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.24098123","doi":"https://doi.org/10.5281/zenodo.24098123","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098123","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.24098176","doi":"https://doi.org/10.5281/zenodo.24098176","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098176","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.24098122","doi":"https://doi.org/10.5281/zenodo.24098122","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24098122","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Advice":[0],"on":[1,7,20,27,85,109,229,262],"DNS-level":[2],"malware":[3,56],"blocking":[4,122,204],"often":[5],"leans":[6],"older":[8],"head-to-head":[9],"tests":[10],"that":[11],"favour":[12],"Quad9":[13,53,153,190,251,268],"over":[14],"Cloudflare.":[15],"We":[16],"re-measure":[17],"the":[18,46,93,123,163,230,255,282],"question":[19],"current":[21],"phishing.":[22],"Every":[23],"hour":[24],"a":[25,28,86,97,142,179,241],"collector":[26],"cloud":[29],"virtual":[30],"machine":[31],"outside":[32],"our":[33],"home":[34,87,242],"network":[35],"pulls":[36],"newly":[37],"listed":[38],"phishing":[39,130,185],"domains":[40,103,131,232],"from":[41],"two":[42,164],"feeds":[43],"(OpenPhish":[44],"and":[45,51,59,75,96,162,173,189,199,209,258,261,281,293],"CERT":[47],"Polska":[48],"warning":[49],"list),":[50],"asks":[52],"(9.9.9.9),":[54],"Cloudflare's":[55,215,234],"filter":[57],"(1.1.1.2)":[58],"an":[60],"unfiltered":[61],"control":[62],"(1.1.1.1)":[63],"whether":[64],"each":[65,139],"domain":[66],"still":[67],"resolves,":[68],"at":[69,147,169,192,211,286],"0,":[70],"1,":[71],"6,":[72],"24,":[73],"72":[74,219],"168":[76,266],"hours":[77,158,171,220,267],"after":[78],"first":[79,132,148,256],"sighting.":[80],"Four":[81],"public":[82],"blocklists":[83],"used":[84],"resolver":[88,243],"are":[89,112,165],"matched":[90],"offline":[91],"against":[92,151,160],"same":[94,231],"domains,":[95],"fixed":[98],"sample":[99],"of":[100],"3,000":[101],"popular":[102],"measures":[104],"false":[105],"positives.":[106],"Domains":[107],"hosted":[108],"shared":[110,263],"platforms":[111],"analysed":[113],"separately":[114],"because":[115],"DNS":[116],"can":[117],"block":[118],"them":[119],"only":[120],"by":[121,156],"platform":[124],"name.":[125],"In":[126],"Atlanta":[127,196],"(1,723":[128],"own-domain":[129],"seen":[133],"31":[134],"October":[135],"to":[136,225,227,236,238,245,273,279,290],"3":[137],"November,":[138],"followed":[140],"for":[141],"week)":[143],"Cloudflare":[144,186,259,276],"blocks":[145,187,222],"most":[146],"sighting":[149],"(17%":[150],"6%),":[152],"overtakes":[154],"it":[155],"six":[157],"(89%":[159],"29%),":[161],"within":[166],"seven":[167],"points":[168],"24":[170,193],"(97%":[172],"91%).":[174],"Blocklists":[175],"add":[176],"little":[177],"until":[178],"day":[180,257],"has":[181,269],"passed.":[182],"On":[183],"shared-hosting":[184],"90%":[188],"23%":[191],"hours.":[194],"Comparing":[195],"with":[197],"Frankfurt":[198],"Singapore":[200],"shows":[201],"Quad9's":[202,221],"early":[203],"is":[205,216,252],"location-dependent":[206],"(18%,":[207],"71%":[208],"49%":[210],"one":[212,246],"hour),":[213],"while":[214,233,275],"not.":[217],"By":[218],"have":[223],"fallen":[224],"83":[226],"87%":[228],"rise":[235],"92":[237],"94%.":[239],"For":[240],"limited":[244],"upstream,":[247],"neither":[248],"service":[249],"dominates:":[250],"better":[253],"in":[254],"thereafter":[260],"hosting.":[264],"At":[265],"levelled":[270],"off":[271],"(82":[272],"86%)":[274],"holds":[277],"(92":[278],"94%),":[280],"blocklists,":[283],"which":[284],"lag":[285],"first,":[287],"reach":[288],"82":[289],"85%.":[291],"Code":[292],"data:":[294],"https://doi.org/10.5281/zenodo.24098038":[295]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-11T00:00:00"}