{"id":"https://openalex.org/W4416549464","doi":"https://doi.org/10.1145/3719027.3744869","title":"Exposing the Roots of DNS Abuse: A Data-Driven Analysis of Key Factors Behind Phishing Domain Registrations","display_name":"Exposing the Roots of DNS Abuse: A Data-Driven Analysis of Key Factors Behind Phishing Domain Registrations","publication_year":2025,"publication_date":"2025-11-19","ids":{"openalex":"https://openalex.org/W4416549464","doi":"https://doi.org/10.1145/3719027.3744869"},"language":"en","primary_location":{"id":"doi:10.1145/3719027.3744869","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3719027.3744869","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://hal.science/hal-05378369","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5020247243","display_name":"Yevheniya Nosyk","orcid":"https://orcid.org/0009-0001-1094-7519"},"institutions":[{"id":"https://openalex.org/I3020098449","display_name":"CEA Grenoble","ror":"https://ror.org/02mg6n827","country_code":"FR","type":"government","lineage":["https://openalex.org/I2738703131","https://openalex.org/I3020098449"]}],"countries":["FR"],"is_corresponding":true,"raw_author_name":"Yevheniya Nosyk","raw_affiliation_strings":["KOR Labs, Grenoble, France"],"raw_orcid":"https://orcid.org/0009-0001-1094-7519","affiliations":[{"raw_affiliation_string":"KOR Labs, Grenoble, France","institution_ids":["https://openalex.org/I3020098449"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011939731","display_name":"Maciej Korczy\u0144ski","orcid":"https://orcid.org/0000-0002-4334-3260"},"institutions":[{"id":"https://openalex.org/I106785703","display_name":"Institut polytechnique de Grenoble","ror":"https://ror.org/05sbt2524","country_code":"FR","type":"education","lineage":["https://openalex.org/I106785703","https://openalex.org/I899635006"]},{"id":"https://openalex.org/I1294671590","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73","country_code":"FR","type":"government","lineage":["https://openalex.org/I1294671590"]},{"id":"https://openalex.org/I4210104430","display_name":"Laboratoire d'Informatique de Grenoble","ror":"https://ror.org/01c8rcg82","country_code":"FR","type":"facility","lineage":["https://openalex.org/I106785703","https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I4210104430","https://openalex.org/I4210159245","https://openalex.org/I899635006","https://openalex.org/I899635006"]},{"id":"https://openalex.org/I899635006","display_name":"Universit\u00e9 Grenoble Alpes","ror":"https://ror.org/02rx3b187","country_code":"FR","type":"education","lineage":["https://openalex.org/I899635006"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Maciej Korczy\u0144ski","raw_affiliation_strings":["KOR Labs, Grenoble, France and Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG, Grenoble, France"],"raw_orcid":"https://orcid.org/0000-0002-4334-3260","affiliations":[{"raw_affiliation_string":"KOR Labs, Grenoble, France and Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG, Grenoble, France","institution_ids":["https://openalex.org/I4210104430","https://openalex.org/I1294671590","https://openalex.org/I899635006","https://openalex.org/I106785703"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048211807","display_name":"Carlos Ga\u00f1\u00e1n","orcid":"https://orcid.org/0000-0002-4699-3007"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Carlos Ga\u00f1\u00e1n","raw_affiliation_strings":["ICANN, Los Angeles, USA"],"raw_orcid":"https://orcid.org/0000-0002-4699-3007","affiliations":[{"raw_affiliation_string":"ICANN, Los Angeles, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5014818336","display_name":"Sourena Maroofi","orcid":"https://orcid.org/0000-0001-6661-7503"},"institutions":[{"id":"https://openalex.org/I3020098449","display_name":"CEA Grenoble","ror":"https://ror.org/02mg6n827","country_code":"FR","type":"government","lineage":["https://openalex.org/I2738703131","https://openalex.org/I3020098449"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Sourena Maroofi","raw_affiliation_strings":["KOR Labs, Grenoble, France"],"raw_orcid":"https://orcid.org/0000-0001-6661-7503","affiliations":[{"raw_affiliation_string":"KOR Labs, Grenoble, France","institution_ids":["https://openalex.org/I3020098449"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109041954","display_name":"Jan Bayer","orcid":"https://orcid.org/0000-0002-2619-1103"},"institutions":[{"id":"https://openalex.org/I3020098449","display_name":"CEA Grenoble","ror":"https://ror.org/02mg6n827","country_code":"FR","type":"government","lineage":["https://openalex.org/I2738703131","https://openalex.org/I3020098449"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Jan Bayer","raw_affiliation_strings":["KOR Labs, Grenoble, France"],"raw_orcid":"https://orcid.org/0000-0002-2619-1103","affiliations":[{"raw_affiliation_string":"KOR Labs, Grenoble, France","institution_ids":["https://openalex.org/I3020098449"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120610206","display_name":"Zul Odgerel","orcid":"https://orcid.org/0009-0009-3254-1403"},"institutions":[{"id":"https://openalex.org/I106785703","display_name":"Institut polytechnique de Grenoble","ror":"https://ror.org/05sbt2524","country_code":"FR","type":"education","lineage":["https://openalex.org/I106785703","https://openalex.org/I899635006"]},{"id":"https://openalex.org/I1294671590","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73","country_code":"FR","type":"government","lineage":["https://openalex.org/I1294671590"]},{"id":"https://openalex.org/I4210104430","display_name":"Laboratoire d'Informatique de Grenoble","ror":"https://ror.org/01c8rcg82","country_code":"FR","type":"facility","lineage":["https://openalex.org/I106785703","https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I4210104430","https://openalex.org/I4210159245","https://openalex.org/I899635006","https://openalex.org/I899635006"]},{"id":"https://openalex.org/I899635006","display_name":"Universit\u00e9 Grenoble Alpes","ror":"https://ror.org/02rx3b187","country_code":"FR","type":"education","lineage":["https://openalex.org/I899635006"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Zul Odgerel","raw_affiliation_strings":["KOR Labs, Grenoble, France and Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG, Grenoble, France"],"raw_orcid":"https://orcid.org/0009-0009-3254-1403","affiliations":[{"raw_affiliation_string":"KOR Labs, Grenoble, France and Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG, Grenoble, France","institution_ids":["https://openalex.org/I4210104430","https://openalex.org/I1294671590","https://openalex.org/I899635006","https://openalex.org/I106785703"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019071393","display_name":"Samaneh Tajalizadehkhoob","orcid":"https://orcid.org/0009-0003-0359-2478"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Samaneh Tajalizadehkhoob","raw_affiliation_strings":["ICANN, Los Angeles, USA"],"raw_orcid":"https://orcid.org/0009-0003-0359-2478","affiliations":[{"raw_affiliation_string":"ICANN, Los Angeles, USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5011315665","display_name":"Andrzej Duda","orcid":"https://orcid.org/0000-0002-6950-6574"},"institutions":[{"id":"https://openalex.org/I106785703","display_name":"Institut polytechnique de Grenoble","ror":"https://ror.org/05sbt2524","country_code":"FR","type":"education","lineage":["https://openalex.org/I106785703","https://openalex.org/I899635006"]},{"id":"https://openalex.org/I1294671590","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73","country_code":"FR","type":"government","lineage":["https://openalex.org/I1294671590"]},{"id":"https://openalex.org/I4210104430","display_name":"Laboratoire d'Informatique de Grenoble","ror":"https://ror.org/01c8rcg82","country_code":"FR","type":"facility","lineage":["https://openalex.org/I106785703","https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I4210104430","https://openalex.org/I4210159245","https://openalex.org/I899635006","https://openalex.org/I899635006"]},{"id":"https://openalex.org/I899635006","display_name":"Universit\u00e9 Grenoble Alpes","ror":"https://ror.org/02rx3b187","country_code":"FR","type":"education","lineage":["https://openalex.org/I899635006"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Andrzej Duda","raw_affiliation_strings":["KOR Labs, Grenoble, France and Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG, Grenoble, France"],"raw_orcid":"https://orcid.org/0000-0002-6950-6574","affiliations":[{"raw_affiliation_string":"KOR Labs, Grenoble, France and Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG, Grenoble, France","institution_ids":["https://openalex.org/I4210104430","https://openalex.org/I1294671590","https://openalex.org/I899635006","https://openalex.org/I106785703"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":8,"corresponding_author_ids":["https://openalex.org/A5020247243"],"corresponding_institution_ids":["https://openalex.org/I3020098449"],"apc_list":null,"apc_paid":null,"fwci":2.7507,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.93433318,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"618","last_page":"632"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9765999913215637,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9765999913215637,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.007699999958276749,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.0035000001080334187,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.8999999761581421},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.7942000031471252},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.71670001745224},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.6873999834060669},{"id":"https://openalex.org/keywords/domain-name","display_name":"Domain name","score":0.4975000023841858},{"id":"https://openalex.org/keywords/blacklisting","display_name":"Blacklisting","score":0.4602000117301941},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3935999870300293}],"concepts":[{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.8999999761581421},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.7942000031471252},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.71670001745224},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.6873999834060669},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.680899977684021},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6802999973297119},{"id":"https://openalex.org/C2988987868","wikidata":"https://www.wikidata.org/wiki/Q32635","display_name":"Domain name","level":3,"score":0.4975000023841858},{"id":"https://openalex.org/C2779797433","wikidata":"https://www.wikidata.org/wiki/Q632959","display_name":"Blacklisting","level":2,"score":0.4602000117301941},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3935999870300293},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.38530001044273376},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.3337000012397766},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.32910001277923584},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.3244999945163727},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.30630001425743103},{"id":"https://openalex.org/C105002631","wikidata":"https://www.wikidata.org/wiki/Q4833645","display_name":"Subject-matter expert","level":3,"score":0.29339998960494995},{"id":"https://openalex.org/C109168655","wikidata":"https://www.wikidata.org/wiki/Q242988","display_name":"Liberian dollar","level":2,"score":0.28110000491142273},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.27399998903274536},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2535000145435333}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3719027.3744869","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3719027.3744869","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:HAL:hal-05378369v1","is_oa":true,"landing_page_url":"https://hal.science/hal-05378369","pdf_url":null,"source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security, Oct 2025, Taipei, Taiwan. pp.618-632, ⟨10.1145/3719027.3744869⟩","raw_type":"Conference papers"}],"best_oa_location":{"id":"pmh:oai:HAL:hal-05378369v1","is_oa":true,"landing_page_url":"https://hal.science/hal-05378369","pdf_url":null,"source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security, Oct 2025, Taipei, Taiwan. pp.618-632, ⟨10.1145/3719027.3744869⟩","raw_type":"Conference papers"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":3,"referenced_works":["https://openalex.org/W2487301225","https://openalex.org/W2941484091","https://openalex.org/W2990244238"],"related_works":[],"abstract_inverted_index":{"Cybercriminals":[0],"have":[1],"long":[2],"depended":[3],"on":[4],"domain":[5,24,86,147,181,200],"names":[6,25],"for":[7,26,109,180],"phishing,":[8],"spam,":[9],"malware":[10],"distribution,":[11],"and":[12,43,75,96,122],"botnet":[13],"operation.":[14],"To":[15],"facilitate":[16],"the":[17,51,73,81,111],"malicious":[18,36,65,78,95,146,192],"activities,":[19],"they":[20],"continually":[21],"register":[22],"new":[23,84],"exploitation.":[27],"Previous":[28],"work":[29],"revealed":[30],"an":[31,160],"abnormally":[32],"high":[33],"concentration":[34],"of":[35,41,77,83,92,106,151],"registrations":[37],"in":[38,59,137,145,163,191,199],"a":[39,56,90,103,127,142,187],"handful":[40],"registrars":[42,176],"TLDs.":[44],"However,":[45],"no":[46],"existing":[47],"study":[48],"systematically":[49],"analyzed":[50],"factors":[52],"driving":[53],"abuse,":[54],"leaving":[55],"critical":[57],"gap":[58],"understanding":[60],"how":[61],"different":[62],"variables":[63],"influence":[64],"registrations.":[66,148],"In":[67],"this":[68],"paper,":[69],"we":[70,101,131],"carefully":[71],"distill":[72],"inclinations":[74],"aversions":[76],"actors":[79],"during":[80],"registration":[82,118,138,168,182,201],"phishing":[85,164],"names.":[87],"Having":[88],"compiled":[89],"list":[91],"14.5":[93],"k":[94,98],"15.4":[97],"benign":[99],"domains,":[100],"collect":[102],"comprehensive":[104],"set":[105],"73":[107],"features":[108],"all":[110],"domains":[112],"encompassing":[113],"three":[114],"main":[115],"latent":[116],"factors:":[117],"attributes,":[119],"proactive":[120],"verification,":[121],"reactive":[123],"security":[124],"practices.":[125],"With":[126],"GLM":[128],"regression":[129],"analysis,":[130],"found":[132],"that":[133],"each":[134],"dollar":[135],"reduction":[136],"fees":[139],"corresponds":[140],"to":[141,202],"49%":[143],"increase":[144],"The":[149,194],"availability":[150],"free":[152],"bundled":[153],"services,":[154],"such":[155],"as":[156],"web":[157],"hosting,":[158],"drives":[159],"88%":[161],"surge":[162],"activities.":[165],"Conversely,":[166],"stringent":[167],"restrictions":[169],"cut":[170],"down":[171],"abuse":[172],"by":[173],"63%,":[174],"while":[175],"providing":[177],"API":[178],"access":[179],"or":[183],"account":[184],"creation":[185],"experience":[186],"staggering":[188],"401%":[189],"rise":[190],"domains.":[193],"results":[195],"enable":[196],"intermediaries":[197],"involved":[198],"develop":[203],"tailored":[204],"anti-abuse":[205],"practices,":[206],"yet":[207],"aligning":[208],"them":[209],"with":[210],"their":[211],"economic":[212],"interests.":[213]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-05-07T13:39:58.223016","created_date":"2025-11-23T00:00:00"}