Differences

This shows you the differences between two versions of the page.

--- provenance:security:domain_abuse [2026/09/25 03:03] – New provenance page for security:domain_abuse: probes, 149 verdicts, hand codes, report/verification/external-check outputs, review log. Authored by Claude. karel.kubicek.claude
+++ provenance:security:domain_abuse [2026/10/08 10:22] (current) – Cite source passages behind ethics-label corrections; Authored by Claude karel.kubicek.claude
@@ Line 225: / Line 225: @@
 | 1 | [[literature:bibliography]] | 1790286292 → 1790303826 | 40 entries appended to a fresh export before ''</bibtex>''; ''bib_dedup_scan.py'' 0 definite duplicates; cache purged |
 | 2 | [[literature:bibliography]] | 1790303826 → 1790304726 | ''roberts2019_impersonation'' added after the generic review cited Roberts et al. (G4); dedup scan 0 definite; cache purged |
+| 3 | [[security:domain_abuse]] | new → 1790305405 | content page |
+| 4 | [[provenance:security:domain_abuse]] | new → 1790305407 | this log (then re-saved with this table) |
+| 5 | [[:security]] | → 1790305423 | ninth row, "nine" in intro/box/heading/methodology, design:dns boundary bullet |
+| 6 | [[:roadmap]] | → 1790305425 | //Assessed// row |
+| 7 | [[provenance:roadmap]] | → 1790305426 | §3f, decisions of 2026-09-25 |
+| 8 | [[design:dns]] | → 1790305428 | "Is this your page?" row pointing here (generic review G10) |
+| 9 | [[security:phishing]] | → 1790305430 | one scope sentence pointing here |
+| 10 | [[provenance:security]] | → 1790305489 | //Ninth child// section, set check 9/9 |
+Render checks after purging the bibliography and each page: [[security:domain_abuse]] has 141 citation markers in source, 282 ''bibtex_citekey'' spans (two per marker), 52 references for 52 distinct keys, 0 "could not be found", 12 tables as in source, 0 ''wikilink2''. All three cross-page anchors resolve on the target pages (''design/dns#pick_the_instrument'', ''practices/ethics#terms_of_service_and_acceptable-use_policies'', ''security/phishing#what_a_blocklist_hit_proves''). 0 ''wikilink2'' on every other touched page. ''report_namespace_overviews.mjs'' exit 0 (''security 9 9 equal''). ''sitemap.mjs'' still exits 1 on the 21 pre-existing bare-link defects on other ''provenance:'' pages, unchanged from the start of the run and not touched here; none is on a page this run wrote.
 ===== Report output, unedited =====
@@ Line 2820: / Line 2830: @@
 }
 </file>
+===== Ethics section closure 2026 10 08 =====
+  * This is a cross-link and attribution correction for the same registration-ethics item, not a new domain-abuse literature survey. The new section is [[practices:ethics#Registering or claiming names to receive misdirected traffic]]; its hand-code updates, review logs and evidence are at [[provenance:practices:ethics#Registration and claiming section 2026 10 08]]. Corpus-level caveats: [[literature:corpus]].
+  * Fresh page source and this log read before edits. Replaced the obsolete open-question box with a pointer. Kaleli's collection cell now names IP addresses and headers rather than implying only counts were stored. The review-count labels now distinguish ethics approval from explicit IRB approval and an exemption from a not-human-subjects determination. The numeric categories are unchanged; Saric reports unspecified ethics approval {[saric2024_hyperlink]}, and Kaleli reports not-human-subjects {[kaleli2021_human]}.
+  * ''node scripts/report_domain_abuse.mjs'' rerun against the current mount. Full output ''ethreg/run20261008/domain-output.txt'' is byte-identical to ''scripts/report_domain_abuse-output.txt''; no figure changed. The full script and output already published above remain the report's audit trail. PASS D output below is an unedited slice of that rerun; it still uses its original category labels, whose reader-facing wording is clarified here. No synonym fold was added.
+  * ''node scripts/verify_domain_abuse_figures.mjs'' also passed. The first run failed because this environment lacked ''pypdf''; supplied it in ''ethreg/run20261008/python-deps'' and reran with ''PYTHONPATH=/workspace/artifacts/wiki/ethreg/run20261008/python-deps''. PDF fallback emitted fontTools warnings; no figure-localisation failure. This is environment repair, not a script/code change. The source reading for this edit uses ''.cols''; the existing verifier also uses PDF fallback for older spliced passages. No claim that this link correction re-verifies unrelated vendor status or laws.
+  * Author: Codex, GPT-6. Generic GPT-6.1-sol review requested the adjacent consistency corrections; recheck recorded in the linked ethics log. The ethics figures and citation reviews separately verified the Saric and Kaleli source distinctions. No rejected finding, no private traffic collected, no discussion block added.
+<code>
+=== PASS D — hand-coded method attributes of the IN papers (from reading notes; see da_fold.mjs) ===
+denominator: the 48 IN papers; eras: 2010–2014 4, 2015–2019 17, 2020–2024 18, 2025–2026* 9
+gen:
+gen          papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+-----------  ------  -----  ---------  ---------  ---------  ----------  -------------------------------------------------------------------------------------------------------
+typo-models  8       16.7%  1          6          0          1           keyboard / edit-distance typo models (omission, insertion, substitution, transposition, missing dot, …)
+combo        4       8.3%   0          3          0          1           trademark plus added tokens (combosquatting)
+bit          3       6.3%   1          1          0          1           single bit flips
+homoglyph    5       10.4%  0          3          1          1           homoglyph / IDN confusables
+sound        1       2.1%   0          0          0          1           homophones (soundsquatting)
+named-tool   4       8.3%   1          2          1          0           a named generator (dnstwist, URLCrazy, ShamFinder/SimChar, the authors' own released tool)
+user-error   1       2.1%   0          0          1          0           names produced by user error that is not a typo of a target (unintended URLs)
+observed     37      77.1%  2          11         16         8           no generator: names come from records, traffic, lists or apps
+src:
+src             papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+--------------  ------  -----  ---------  ---------  ---------  ----------  -------------------------------------------------------------------------------
+zone            20      41.7%  2          8          7          3           TLD zone files (CZDS, registry agreement, open ccTLD AXFR, or a zone archive)
+ct              6       12.5%  0          2          2          2           Certificate Transparency / certificate scans
+pdns            11      22.9%  1          3          4          3           passive DNS
+active-dns      11      22.9%  0          3          5          3           active DNS datasets or the authors' own large-scale resolution
+resolution      2       4.2%   1          1          0          0           the authors resolved their own generated candidates
+drop-lists      5       10.4%  0          4          1          0           pending-delete / drop lists, registry deletion data
+whois           31      64.6%  2          15         9          5           WHOIS, live or historical
+rdap            1       2.1%   0          1          0          0           RDAP
+registry        3       6.3%   0          3          0          0           registry- or ICANN-provided data, registry partner
+web-crawl       8       16.7%  1          5          2          0           a web crawl or web corpus (own, Common Crawl, archives)
+app-traffic     4       8.3%   0          0          1          3           app code or app traffic
+toplist         18      37.5%  2          7          6          3           a top list or company list as the target set
+threat-intel    6       12.5%  2          3          0          1           blocklists and threat feeds as a source of names
+traffic-logs    4       8.3%   0          3          1          0           traffic, query or delivery logs (ISP, enterprise, root servers, email provider)
+cache-snooping  1       2.1%   0          0          1          0           public-resolver cache snooping
+other           10      20.8%  0          0          6          4           another source (dispute records, IP allocations, resolver or provider lists)
+whois:
+whois       papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+----------  ------  -----  ---------  ---------  ---------  ----------  ------------------------
+none        17      35.4%  2          2          9          4           not used
+live        25      52.1%  2          13         6          4           live WHOIS
+historical  10      20.8%  0          3          3          4           historical WHOIS product
+rdap        1       2.1%   0          1          0          0           RDAP
+label:
+label       papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+----------  ------  -----  ---------  ---------  ---------  ----------  --------------------------------------
+manual      32      66.7%  4          12         10         6           researchers looked
+heuristic   36      75.0%  4          13         11         8           rules
+classifier  7       14.6%  1          4          1          1           trained classifier
+blocklist   13      27.1%  2          7          3          1           blocklist / VirusTotal / Safe Browsing
+vendor      6       12.5%  1          2          3          0           commercial categoriser or vendor feed
+none        3       6.3%   0          0          3          0           no labelling
+ethics:
+ethics        papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+------------  ------  -----  ---------  ---------  ---------  ----------  ------------------------------------------------------------------------------
+approved      4       8.3%   0          2          2          0           an IRB or ethics board approved (any part of) the study
+exempt        3       6.3%   0          1          2          0           an IRB ruled it exempt / not human-subjects research
+other-body    3       6.3%   0          0          3          0           approved by a non-IRB body (general counsel, the partner's network department)
+discussed     21      43.8%  1          2          10         8           ethics section, no review body
+not-required  1       2.1%   0          0          1          0           authors state no review was needed
+none          16      33.3%  3          12         0          1           nothing
+notify:
+notify  papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+------  ------  -----  ---------  ---------  ---------  ----------  ------------------------------------------------------
+yes     24      50.0%  0          4          14         6           notified someone (owners, providers, registries, CERT)
+no      12      25.0%  1          7          2          2           no notification stated
+na      12      25.0%  3          6          2          1           nothing to notify
+time:
+time          papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+------------  ------  -----  ---------  ---------  ---------  ----------  ----------------------
+longitudinal  35      72.9%  4          12         12         7           repeated observation
+snapshot      13      27.1%  0          5          6          2           one observation window
+artifacts:
+artifacts  papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+---------  ------  -----  ---------  ---------  ---------  ----------  -------------------
+public     14      29.2%  0          4          6          4           code or data public
+promised   2       4.2%   0          1          0          1           promised
+request    2       4.2%   0          0          1          1           on request
+none       30      62.5%  4          12         11         3           none mentioned
+gen among the 14 lookalike papers:
+gen          papers  of 14  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+-----------  ------  -----  ---------  ---------  ---------  ----------  -------------------------------------------------------------------------------------------------------
+typo-models  7       50.0%  1          5          0          1           keyboard / edit-distance typo models (omission, insertion, substitution, transposition, missing dot, …)
+combo        4       28.6%  0          3          0          1           trademark plus added tokens (combosquatting)
+bit          3       21.4%  1          1          0          1           single bit flips
+homoglyph    5       35.7%  0          3          1          1           homoglyph / IDN confusables
+sound        1       7.1%   0          0          0          1           homophones (soundsquatting)
+named-tool   3       21.4%  1          2          0          0           a named generator (dnstwist, URLCrazy, ShamFinder/SimChar, the authors' own released tool)
+user-error   1       7.1%   0          0          1          0           names produced by user error that is not a typo of a target (unintended URLs)
+observed     3       21.4%  0          1          1          1           no generator: names come from records, traffic, lists or apps
+use among the 30 papers that classify what the names do (use is not only na / unused / traffic-only):
+use              papers  of 30  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
+---------------  ------  -----  ---------  ---------  ---------  ----------  ---------------------------------------------
+parked           15      50.0%  3          8          3          1           parked / ads
+defensive        8       26.7%  1          4          1          2           defensive registration by the owner
+redirect-target  3       10.0%  1          2          0          0           redirects to the target
+redirect-other   13      43.3%  3          6          2          2           redirects elsewhere
+affiliate        5       16.7%  2          3          0          0           affiliate abuse
+malicious        24      80.0%  4          11         6          3           malicious (blocklist, VirusTotal, manual)
+phishing         4       13.3%  1          2          0          1           phishing
+for-sale         5       16.7%  0          4          0          1           for sale
+unused           13      43.3%  0          4          5          4           unused / unregistered / no DNS
+content          8       26.7%  1          5          1          1           own content
+error            7       23.3%  0          6          1          0           error pages
+traffic-only     1       3.3%   1          0          0          0           only the traffic it receives is measured
+na               0       0.0%   0          0          0          0           the paper does not classify what the names do
+of those 30, separate defensive registrations: 8 (2014,2015,2015,2015,2019,2020,2025,2025); the rest cannot tell a brand's own registration from a squat unless they say so
+registered domains themselves: 15 of 48 papers (exact count not stated for 2); total over the 13 with an exact count: 535 domains; claimed third-party names, zones, NS slots or cloud IPs: 6; either: 19
+per paper that registered or claimed (year — key — reg — claimed — ethics — notify):
+  understanding-the-dark-side-of-domain-parking                 reg=23  claimed=no  ethics=discussed  notify=no
+  parking-sensors-analyzing-and-detecting-parked-domains        reg=1  claimed=no  ethics=none  notify=no
+  client-side-name-collision-vulnerability-in-the-new-gtld-era  reg=1  claimed=no  ethics=none  notify=no
+  email-typosquatting                                           reg=76  claimed=no  ethics=approved  notify=na
+  cracking-the-wall-of-confinement-understanding-and-analyzing  reg=0  claimed=yes  ethics=none  notify=yes
+  zombie-awakening-stealthy-hijacking-of-active-domains-throug  reg=n/s  claimed=no  ethics=discussed  notify=yes
+  risky-bizness-risks-derived-from-registrar-name-management    reg=5  claimed=yes  ethics=other-body  notify=yes
+  to-err-is-human-characterizing-the-threat-of-unintended-urls  reg=45  claimed=no  ethics=exempt  notify=no
+  domains-do-change-their-spots-quantifying-potential-abuse-of  reg=201  claimed=no  ethics=discussed  notify=na
+  measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clou  reg=0  claimed=yes  ethics=exempt  notify=yes
+  dial-n-for-nxdomain-the-scale-origin-and-security-implicatio  reg=19  claimed=no  ethics=discussed  notify=yes
+  wolf-in-sheeps-clothing-evaluating-security-risks-of-the-und  reg=0  claimed=yes  ethics=discussed  notify=yes
+  bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-  reg=30  claimed=no  ethics=other-body  notify=yes
+  cross-the-zone-toward-a-covert-domain-hijacking-via-shared-d  reg=0  claimed=yes  ethics=discussed  notify=yes
+  rethinking-the-security-threats-of-stale-dns-glue-records     reg=n/s  claimed=yes  ethics=discussed  notify=yes
+  hyperlink-hijacking-exploiting-erroneous-url-links-to-phanto  reg=51  claimed=no  ethics=approved  notify=no
+*  automatic-insecurity-exploring-email-auto-configuration-in-t  reg=2  claimed=no  ethics=discussed  notify=yes
+*  cross-origin-web-attacks-via-http-2-server-push-and-signed-h  reg=1  claimed=no  ethics=discussed  notify=yes
+*  misty-registry-an-empirical-study-of-flawed-domain-registry-  reg=80  claimed=no  ethics=discussed  notify=yes
+of those, logged the traffic, mail or queries that arrived for someone else (hand list LOGGED_ARRIVALS): 7 — years 2017,2021,2021,2022,2022,2023,2024
+review outcome among those 19: approved 2, exempt 2, other-body 2, discussed 10, not-required 0, none 3
+papers whose use label includes "traffic-only" (the measurement is what the name receives): 5 (2014,2020,2022,2022,2024)
+lookalike papers with a top list or company list as the target set: 9 of 14
+ethics = none: 12 of the 17 papers from 2015–2019; 1 of the 27 from 2020–2026*; ethics section without a review body (discussed) among 2020–2026*: 18
+section-level papers by year: 2020, 2023, 2024, 2024, 2025, 2025, 2025, 2025; from 2023–2025: 7 of 8
+WHOIS/RDAP used: 31 of 48; historical product: 10; RDAP: 1; used WHOIS by era: 2010–2014 2/4, 2015–2019 15/17, 2020–2024 9/18, 2025–2026* 5/9
+per paper:
+dang/P an-empirical-study-of-orphan-dns-servers-in- gen=observed | src=zone+threat-intel | whois=none | use=malicious+content | label=heuristic+manual+blocklist | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
+look/P bitsquatting-exploiting-bit-flips-for-fun-or gen=bit | src=toplist+resolution+web-crawl | whois=none | use=parked+affiliate+malicious+redirect-other | label=manual+heuristic+vendor | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
+look/P the-long-taile-of-typosquatting-domain-names gen=typo-models+named-tool | src=zone+toplist+threat-intel+whois | whois=live | use=parked+redirect-target+redirect-other+affiliate+malicious+phishing+defensive | label=heuristic+classifier+manual+blocklist | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
+park/P understanding-the-dark-side-of-domain-parkin gen=observed | src=pdns+whois | whois=live | use=parked+redirect-other+malicious+traffic-only | label=heuristic+manual | reg=23 | claimed=n | ethics=discussed | notify=no | longitudinal | art=none
+look/P every-second-counts-quantifying-the-negative gen=typo-models+observed | src=traffic-logs+web-crawl+whois | whois=live | use=defensive+redirect-target+malicious+parked+unused | label=heuristic+manual+blocklist | reg=0 | claimed=n | ethics=exempt | notify=na | longitudinal | art=none
+park/P from-academy-to-zone-an-analysis-of-the-new- gen=observed | src=zone+registry+whois+active-dns+web-crawl+toplist | whois=live | use=parked+unused+defensive+redirect-other+content+for-sale+error | label=classifier+manual+heuristic | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
+park/P parking-sensors-analyzing-and-detecting-park gen=observed+typo-models | src=zone+whois+toplist+web-crawl | whois=live | use=parked+redirect-other+malicious | label=heuristic+manual+classifier | reg=1 | claimed=n | ethics=none | notify=no | snapshot | art=none
+look/P seven-months-worth-of-mistakes-a-longitudina gen=typo-models | src=toplist+resolution+web-crawl+whois | whois=live | use=parked+defensive+redirect-target+redirect-other+affiliate+malicious+content+for-sale+error | label=heuristic+manual | reg=0 | claimed=n | ethics=none | notify=no | longitudinal | art=public
+resi/P domain-z-28-registrations-later-measuring-th gen=observed | src=zone+drop-lists+threat-intel+whois | whois=historical | use=malicious+redirect-other+unused | label=heuristic | reg=0 | claimed=n | ethics=none | notify=yes | longitudinal | art=none
+resi/P mitm-attack-by-name-collision-cause-analysis gen=observed | src=traffic-logs+zone+whois+registry | whois=historical | use=unused+na | label=heuristic | reg=0 | claimed=n | ethics=discussed | notify=no | longitudinal | art=none
+resi/P whois-lost-in-translation-mis-understanding- gen=observed | src=zone+whois | whois=live | use=na | label=heuristic | reg=0 | claimed=n | ethics=none | notify=no | longitudinal | art=none
+resi/P client-side-name-collision-vulnerability-in- gen=observed | src=traffic-logs | whois=none | use=na | label=manual+heuristic | reg=1 | claimed=n | ethics=none | notify=no | snapshot | art=none
+look/P hiding-in-plain-sight-a-longitudinal-study-o gen=combo | src=pdns+active-dns+ct+threat-intel+toplist+whois | whois=live | use=phishing+affiliate+malicious+parked+error+content | label=manual+heuristic+vendor+blocklist | reg=0 | claimed=n | ethics=none | notify=no | longitudinal | art=none
+look/P email-typosquatting                          gen=typo-models | src=zone+whois | whois=live | use=na | label=heuristic+manual | reg=76 | claimed=n | ethics=approved | notify=na | longitudinal | art=promised
+resi/P game-of-registrars-an-empirical-analysis-of- gen=observed | src=drop-lists+whois+registry | whois=live | use=parked+for-sale+malicious+error | label=manual | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
+resi/P from-deletion-to-re-registration-in-zero-sec gen=observed | src=drop-lists+rdap+whois | whois=rdap+live | use=malicious | label=blocklist | reg=0 | claimed=n | ethics=none | notify=no | snapshot | art=none
+look/P needle-in-a-haystack-tracking-down-elite-phi gen=homoglyph+typo-models+bit+combo+named-tool | src=active-dns+toplist+whois | whois=live | use=phishing | label=classifier+manual | reg=0 | claimed=n | ethics=none | notify=yes | snapshot | art=public
+resi/P panning-for-gold-com-understanding-the-dynam gen=observed | src=zone+drop-lists+whois+web-crawl | whois=live | use=parked+error+malicious+affiliate+content+unused | label=classifier+heuristic+manual+blocklist+vendor | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
+look/P you-are-who-you-appear-to-be-a-longitudinal- gen=typo-models+combo+homoglyph | src=ct+whois+toplist | whois=live | use=malicious | label=blocklist | reg=0 | claimed=n | ethics=approved | notify=na | longitudinal | art=public
+look/P shamfinder-an-automated-framework-for-detect gen=homoglyph+named-tool | src=zone+toplist+pdns | whois=none | use=parked+redirect-other+for-sale+error+malicious+content+defensive | label=heuristic+manual+blocklist | reg=0 | claimed=n | ethics=discussed | notify=yes | snapshot | art=public
+resi/P cracking-the-wall-of-confinement-understandi gen=observed | src=pdns+whois+threat-intel | whois=live+historical | use=malicious+redirect-other | label=heuristic+manual+blocklist | reg=0 | claimed=y | ethics=none | notify=yes | longitudinal | art=none
+dang/P zombie-awakening-stealthy-hijacking-of-activ gen=observed | src=toplist+pdns+other+whois | whois=live | use=na | label=vendor | reg=n/s | claimed=n | ethics=discussed | notify=yes | longitudinal | art=none
+look/S trufflehunter-cache-snooping-rare-domains-at gen=observed | src=cache-snooping | whois=none | use=traffic-only | label=none | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=public
+dang/P unresolved-issues-prevalence-persistence-and gen=observed | src=zone+active-dns+whois | whois=live | use=unused+error+malicious+parked+defensive | label=heuristic+manual | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=none
+dang/P risky-bizness-risks-derived-from-registrar-n gen=observed | src=zone+whois | whois=historical | use=parked+redirect-other+unused | label=heuristic+manual | reg=5 | claimed=y | ethics=other-body | notify=yes | longitudinal | art=none
+look/P to-err-is-human-characterizing-the-threat-of gen=user-error | src=other+web-crawl | whois=none | use=content+parked+malicious+unused | label=manual+blocklist+classifier | reg=45 | claimed=n | ethics=exempt | notify=no | longitudinal | art=public
+look/P assessing-browser-level-defense-against-idn- gen=homoglyph | src=zone+toplist | whois=none | use=na | label=none | reg=0 | claimed=n | ethics=approved | notify=yes | snapshot | art=public
+dang/P can-i-take-your-subdomain-exploring-same-sit gen=observed | src=toplist+ct+other+whois | whois=live | use=unused+redirect-other+malicious | label=heuristic+manual | reg=0 | claimed=n | ethics=discussed | notify=yes | snapshot | art=none
+resi/P domains-do-change-their-spots-quantifying-po gen=observed | src=pdns+drop-lists | whois=none | use=traffic-only | label=heuristic+manual | reg=201 | claimed=n | ethics=discussed | notify=na | longitudinal | art=none
+dang/P measuring-and-mitigating-the-risk-of-ip-reus gen=observed | src=other+toplist | whois=none | use=traffic-only | label=manual+heuristic | reg=0 | claimed=y | ethics=exempt | notify=yes | longitudinal | art=none
+resi/S iotflow-inferring-iot-device-behavior-at-sca gen=observed | src=app-traffic+whois | whois=live | use=unused | label=manual | reg=0 | claimed=n | ethics=discussed | notify=yes | snapshot | art=public
+resi/P dial-n-for-nxdomain-the-scale-origin-and-sec gen=observed | src=pdns+whois | whois=historical | use=malicious+unused | label=vendor+blocklist | reg=19 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=request
+resi/P stale-tls-certificates-investigating-precari gen=observed | src=ct+whois+zone | whois=historical | use=malicious | label=vendor+heuristic+manual | reg=0 | claimed=n | ethics=not-required | notify=na | longitudinal | art=none
+dang/P wolf-in-sheeps-clothing-evaluating-security- gen=observed | src=toplist+pdns+other | whois=none | use=malicious | label=blocklist+heuristic | reg=0 | claimed=y | ethics=discussed | notify=yes | snapshot | art=public
+resi/S bounce-in-the-wild-a-deep-dive-into-email-de gen=observed+named-tool | src=traffic-logs+active-dns+whois | whois=live | use=unused | label=heuristic | reg=30 | claimed=n | ethics=other-body | notify=yes | longitudinal | art=none
+dang/S understanding-the-implementation-and-securit gen=observed | src=active-dns+other | whois=none | use=unused | label=heuristic | reg=0 | claimed=n | ethics=other-body | notify=yes | snapshot | art=public
+dang/P cross-the-zone-toward-a-covert-domain-hijack gen=observed | src=zone+toplist+whois | whois=live | use=unused | label=heuristic+manual | reg=0 | claimed=y | ethics=discussed | notify=yes | snapshot | art=none
+dang/P rethinking-the-security-threats-of-stale-dns gen=observed | src=zone+active-dns | whois=none | use=na | label=none | reg=n/s | claimed=y | ethics=discussed | notify=yes | longitudinal | art=none
+resi/P hyperlink-hijacking-exploiting-erroneous-url gen=observed | src=web-crawl+zone+active-dns | whois=none | use=traffic-only | label=heuristic+manual | reg=51 | claimed=n | ethics=approved | notify=no | longitudinal | art=none
+* dang/S measuring-the-time-source-vulnerabilities-in gen=observed | src=active-dns+other | whois=none | use=unused | label=heuristic | reg=0 | claimed=n | ethics=discussed | notify=no | snapshot | art=request
+* resi/S automatic-insecurity-exploring-email-auto-co gen=observed | src=toplist+other | whois=none | use=unused | label=heuristic | reg=2 | claimed=n | ethics=discussed | notify=yes | snapshot | art=none
+* resi/S cross-origin-web-attacks-via-http-2-server-p gen=observed | src=whois+active-dns+ct+pdns+toplist | whois=live+historical | use=unused | label=heuristic | reg=1 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=none
+* look/P the-guardians-of-name-street-studying-the-de gen=typo-models+bit+homoglyph+sound+combo | src=zone+pdns+whois+toplist | whois=live+historical | use=defensive | label=heuristic+manual | reg=0 | claimed=n | ethics=discussed | notify=no | longitudinal | art=public
+* resi/S welcome-to-jurassic-park-a-comprehensive-stu gen=observed | src=app-traffic | whois=none | use=unused+for-sale | label=manual+heuristic | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=none
+* resi/P lost-in-the-mists-of-time-expirations-in-dns gen=observed | src=app-traffic+pdns+whois | whois=historical | use=unused+malicious+parked+content | label=manual+heuristic | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=public
+* dang/P misty-registry-an-empirical-study-of-flawed- gen=observed | src=zone+whois+other | whois=live+historical | use=defensive+unused+redirect-other+phishing | label=manual+heuristic | reg=80 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=promised
+* look/P repairing-trust-in-domain-name-disputes-prac gen=observed | src=other+zone+threat-intel | whois=none | use=malicious | label=blocklist+classifier+manual | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=public
+* resi/P dead-domains-living-data-a-privacy-risk-anal gen=observed | src=app-traffic+whois+active-dns+ct | whois=live | use=unused+redirect-other+malicious | label=heuristic+manual | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=public
+</code>
+====== References ======
+<bibtex bibliography></bibtex>