{"id":"https://openalex.org/W7123570979","doi":"https://doi.org/10.1186/s42400-025-00523-w","title":"Darkness at dawn: understanding illicit websites in newly registered domain names","display_name":"Darkness at dawn: understanding illicit websites in newly registered domain names","publication_year":2026,"publication_date":"2026-01-14","ids":{"openalex":"https://openalex.org/W7123570979","doi":"https://doi.org/10.1186/s42400-025-00523-w"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-025-00523-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00523-w","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00523-w.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00523-w.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5035286001","display_name":"Bingyang Guo","orcid":"https://orcid.org/0000-0002-1166-2830"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bingyang Guo","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China"],"raw_orcid":"https://orcid.org/0000-0002-1166-2830","affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101990657","display_name":"Yunyi Zhang","orcid":"https://orcid.org/0000-0001-6906-7519"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yunyi Zhang","raw_affiliation_strings":["Institute of Network Science and Cyberspace, Tsinghua University, Beijing, 100089, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Network Science and Cyberspace, Tsinghua University, Beijing, 100089, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011736896","display_name":"Fan Shi","orcid":"https://orcid.org/0000-0003-4533-2706"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fan Shi","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122919413","display_name":"Min Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Min Zhang","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100784176","display_name":"Pengfei Xue","orcid":"https://orcid.org/0000-0002-9877-9360"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pengfei Xue","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050637129","display_name":"Chengxi Xu","orcid":"https://orcid.org/0000-0001-7405-7710"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chengxi Xu","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5122919622","display_name":"Yi Shen","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yi Shen","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5122989070","display_name":"Miao Hu","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Miao Hu","raw_affiliation_strings":["College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Electronic Engineering, National University of Defense Technology, Hefei, 230037, Anhui, China","institution_ids":["https://openalex.org/I170215575"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":8,"corresponding_author_ids":["https://openalex.org/A5122919413"],"corresponding_institution_ids":["https://openalex.org/I170215575"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.04173395,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.5138000249862671,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.5138000249862671,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.3402000069618225,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12380","display_name":"Authorship Attribution and Profiling","score":0.023399999365210533,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6912000179290771},{"id":"https://openalex.org/keywords/flexibility","display_name":"Flexibility (engineering)","score":0.6603000164031982},{"id":"https://openalex.org/keywords/invisibility","display_name":"Invisibility","score":0.6406999826431274},{"id":"https://openalex.org/keywords/illicit-drug","display_name":"Illicit drug","score":0.6144000291824341},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6036999821662903},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.5821999907493591},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.451200008392334},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.4366999864578247}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6912000179290771},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.6603000164031982},{"id":"https://openalex.org/C50962388","wikidata":"https://www.wikidata.org/wiki/Q762018","display_name":"Invisibility","level":2,"score":0.6406999826431274},{"id":"https://openalex.org/C3020689752","wikidata":"https://www.wikidata.org/wiki/Q844924","display_name":"Illicit drug","level":3,"score":0.6144000291824341},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6036999821662903},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5821999907493591},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.557200014591217},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.5455999970436096},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.451200008392334},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.4366999864578247},{"id":"https://openalex.org/C43091099","wikidata":"https://www.wikidata.org/wiki/Q1067788","display_name":"Through-the-lens metering","level":3,"score":0.40290001034736633},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.3765999972820282},{"id":"https://openalex.org/C2988987868","wikidata":"https://www.wikidata.org/wiki/Q32635","display_name":"Domain name","level":3,"score":0.36160001158714294},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.3517000079154968},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.3490999937057495},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.31310001015663147},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2874000072479248},{"id":"https://openalex.org/C518677369","wikidata":"https://www.wikidata.org/wiki/Q202833","display_name":"Social media","level":2,"score":0.2793000042438507},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2759000062942505},{"id":"https://openalex.org/C183003079","wikidata":"https://www.wikidata.org/wiki/Q1000371","display_name":"Personalization","level":2,"score":0.2567000091075897},{"id":"https://openalex.org/C3019036681","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"Internet users","level":3,"score":0.2565999925136566},{"id":"https://openalex.org/C112698675","wikidata":"https://www.wikidata.org/wiki/Q37038","display_name":"Advertising","level":1,"score":0.2540999948978424},{"id":"https://openalex.org/C22111027","wikidata":"https://www.wikidata.org/wiki/Q1070427","display_name":"Internet security","level":4,"score":0.2538999915122986}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-025-00523-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00523-w","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00523-w.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:373c8c9f8e194c7bb9b5ccb33df0ef61","is_oa":true,"landing_page_url":"https://doaj.org/article/373c8c9f8e194c7bb9b5ccb33df0ef61","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 9, Iss 1, Pp 1-20 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-025-00523-w","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00523-w","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00523-w.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6901620030403137,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G2035375699","display_name":null,"funder_award_id":"2022YFB3102902","funder_id":"https://openalex.org/F4320335774","funder_display_name":"Key Technologies Research and Development Program"},{"id":"https://openalex.org/G46527380","display_name":null,"funder_award_id":"2022YFB3102902","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320335774","display_name":"Key Technologies Research and Development Program","ror":null},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7123570979.pdf","grobid_xml":"https://content.openalex.org/works/W7123570979.grobid-xml"},"referenced_works_count":24,"referenced_works":["https://openalex.org/W1984816986","https://openalex.org/W1990497396","https://openalex.org/W2070440035","https://openalex.org/W2094257886","https://openalex.org/W2510523362","https://openalex.org/W2533677686","https://openalex.org/W2604955674","https://openalex.org/W2794855529","https://openalex.org/W2805724970","https://openalex.org/W2946898425","https://openalex.org/W2980748551","https://openalex.org/W2990296034","https://openalex.org/W3043102860","https://openalex.org/W3131874937","https://openalex.org/W3155384719","https://openalex.org/W3180029035","https://openalex.org/W4288057701","https://openalex.org/W4295969306","https://openalex.org/W4307020407","https://openalex.org/W4312583375","https://openalex.org/W4367047478","https://openalex.org/W4388426041","https://openalex.org/W4388960072","https://openalex.org/W4400314587"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"Illicit":[1],"website":[2,41,69,81,263],"represents":[3],"a":[4,64,129,160,193,239,282],"significant":[5],"challenge":[6],"on":[7,39,224],"the":[8,12,18,54,60,77,92,98,225,254,272,287,294,304],"Internet.":[9],"Miscreants":[10],"exploit":[11],"inherent":[13],"flexibility":[14],"and":[15,27,44,71,127,134,152,176,178,195,274],"invisibility":[16],"of":[17,56,67,80,91,94,101,115,147,150,156,201,203,211,219,261,276,286,290,296,307],"Internet":[19],"to":[20,30,303],"promote":[21],"illicit":[22,40,46,68,95,117,136,157,190,207,248,262,277,291,308],"activities,":[23,249],"particularly":[24,75],"online":[25],"gambling":[26],"pornography,":[28],"intending":[29],"generate":[31],"substantial":[32],"profits.":[33],"Previous":[34],"studies":[35],"have":[36],"primarily":[37],"focused":[38],"detection":[42],"techniques":[43],"analyzed":[45,271],"activities":[47,93,118,137,289],"using":[48],"passive":[49,57],"datasets.":[50],"However,":[51],"constrained":[52],"by":[53],"limitations":[55],"dataset":[58],"perspectives,":[59],"security":[61],"community":[62],"lacks":[63],"global":[65,240],"understanding":[66],"deployment":[70,273],"operational":[72],"behavior":[73],"patterns,":[74],"during":[76,119],"early":[78],"stages":[79],"activation.":[82],"In":[83],"this":[84],"paper,":[85],"we":[86,125,167,243,270],"conduct":[87],"an":[88,199],"in-depth":[89],"analysis":[90,184],"websites":[96,292],"through":[97],"advantageous":[99],"lens":[100],"newly":[102],"registered":[103],"domains":[104,151,174,213,221],"(NRDs).":[105],"The":[106],"NRD":[107,241],"dataset\u2019s":[108],"key":[109],"strength":[110],"is":[111],"its":[112],"broad":[113],"coverage":[114],"emerging":[116],"observation,":[120],"complementing":[121],"previous":[122],"studies.":[123],"Specifically,":[124],"designed":[126],"implemented":[128],"framework,":[130],"NRDMiner,":[131],"for":[132,206],"tracking":[133],"analyzing":[135],"associated":[138],"with":[139,198,258],"large-scale":[140,283],"NRDs.":[141],"This":[142],"framework":[143],"supports":[144],"long-term":[145],"monitoring":[146],"vast":[148],"quantities":[149],"enables":[153],"accurate":[154],"identification":[155],"websites.":[158,278],"Over":[159],"133-day":[161],"period":[162],"(July":[163],"1\u2013Nov":[164],"10,":[165],"2024),":[166],"collected":[168],"27,623,326":[169],"NRDs":[170,204],"across":[171],"481":[172],"top-level":[173],"(e.g.,":[175],"),":[177],"identified":[179,252],"910,794":[180],"abusive":[181,220],"domains.":[182],"Our":[183,279],"highlights":[185],"several":[186],"important":[187],"patterns.":[188],"First,":[189],"activity":[191],"shows":[192],"consistent":[194],"steady":[196],"pattern,":[197],"average":[200],"3.3%":[202],"flagged":[205],"website.":[208],"Moreover,":[209],"98%":[210],"these":[212],"are":[214,222,229],"first-time":[215],"registrations.":[216],"Second,":[217],"60%":[218],"activated":[223],"same":[226],"day":[227],"they":[228],"registered,":[230],"indicating":[231],"mature":[232],"automated":[233],"domain":[234],"abuse":[235],"techniques.":[236],"Third,":[237],"from":[238,293],"perspective,":[242],"observed":[244],"regional":[245],"tendencies":[246],"in":[247,266],"like":[250],"Asia":[251],"as":[253],"primary":[255],"concentration":[256],"area,":[257],"over":[259],"70%":[260],"pages":[264],"being":[265],"Asian":[267],"languages.":[268],"Furthermore,":[269],"operation":[275],"work":[280],"provides":[281],"empirical":[284],"study":[285],"early-stage":[288],"perspective":[295],"NRDs,":[297],"offering":[298],"valuable":[299],"evidence":[300],"that":[301],"contribute":[302],"timely":[305],"mitigation":[306],"activities.":[309]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-01-14T00:00:00"}