Measure The Web

User Tools

Site Tools

Trace: • tracker_radar_collector • artifacts
security:domain_abuse

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

security:domain_abuse [2026/09/25 03:03] – New page: measuring domain-namespace abuse (squatting, parking, expired domains, dangling DNS). 48 papers hand-verdicted from 149 candidates; provenance at provenance:security:domain_abuse. Authored by Claude. karel.kubicek.claudesecurity:domain_abuse [2026/10/08 10:21] (current) – Link completed registration ethics section and clarify approval and collection labels; Authored by Claude karel.kubicek.claude
Line 166: Line 166:
 ===== Registering names to measure them ===== ===== Registering names to measure them =====
  
-<WRAP todo> +The defaults for whether to receive traffic, what to retain and answer, who reviews the protocol, and what happens to the name afterwards are now in [[practices:ethics#Registering or claiming names to receive misdirected traffic|Ethics: registering and claiming names]]. This section records the measurement choices those defaults draw on.
-**Open question for [[Practices:Ethics]]:** that page covers crawling, scanning and notification, but not the practice this section describes — **registering or claiming a name in order to receive the traffic, mail or queries meant for someone else.** Nineteen papers here registered or claimed names; seven of them — the traffic-logging rows of the table below — did it to see what arrived. The decisions below are what a review board will ask about, and the papers answer them differently. A section on [[Practices:Ethics]] that states a default for each would close this. +
-</WRAP>+
  
-**15** of the 48 papers registered domains themselves — **535** domains across the 13 that state an exact count, from one (a lab testbed) to 201; the other two give only a lower bound — and **6** took control of third-party resources: a seized domain's nameserver slot, 1.5 million cloud IPs, other people's zones on DNS-hosting services. Of these 19, **2** report IRB approval, **2** an IRB exemption, **2** approval by a non-IRB body (university counsel; an industry partner's network department), **10** an ethics section with no review body, and **3** nothing.+**15** of the 48 papers registered domains themselves — **535** domains across the 13 that state an exact count, from one (a lab testbed) to 201; the other two give only a lower bound — and **6** took control of third-party resources: a seized domain's nameserver slot, 1.5 million cloud IPs, other people's zones on DNS-hosting services. Of these 19, **2** report ethics approval (one explicitly IRB), **2** an exemption or not-human-subjects determination, **2** approval by a non-IRB body (university counsel; an industry partner's network department), **10** an ethics section with no review body, and **3** nothing.
  
 ^ Paper ^ Registered or claimed ^ What they collected, and what they did with it ^ Review, as stated ^ ^ Paper ^ Registered or claimed ^ What they collected, and what they did with it ^ Review, as stated ^
 | {[szurdi2017_email]} | 76 typo domains of email providers, over seven months | millions of emails; sensitive strings removed by regular expression before storage, encrypted with a key kept elsewhere | IRB approved (the authors' and their sponsor's) | | {[szurdi2017_email]} | 76 typo domains of email providers, over seven months | millions of emails; sensitive strings removed by regular expression before storage, encrypted with a key kept elsewhere | IRB approved (the authors' and their sponsor's) |
-| {[kaleli2021_human]} | 45 unintended-URL domains, registered within hours of the tweet | visit counts only; "we do not interact in any way with the users" | IRB: not human-subjects research |+| {[kaleli2021_human]} | 45 unintended-URL domains, registered within hours of the tweet | client IP addresses and request headers; results reported as visit counts | IRB: not human-subjects research |
 | {[so2022_spots]} | 201 expired domains | 650,737,621 requests; a 404 page carrying bot traps and fingerprinting JavaScript; never engaged clients; the domains **expired back into the pool** afterwards | ethics section, no review body | | {[so2022_spots]} | 201 expired domains | 650,737,621 requests; a 404 page carrying bot traps and fingerprinting JavaScript; never engaged clients; the domains **expired back into the pool** afterwards | ethics section, no review body |
 | {[liu2023_dial]} | 19 NXDomains, six months | 5,925,311 queries, passive only; personal data anonymised, then deleted before publication; the authors will **keep renewing** the domains | ethics appendix, no review body | | {[liu2023_dial]} | 19 NXDomains, six months | 5,925,311 queries, passive only; personal data anonymised, then deleted before publication; the authors will **keep renewing** the domains | ethics appendix, no review body |
Line 272: Line 270:
 | Notified someone | 24; no notification stated 12; nothing to notify 12 | | Notified someone | 24; no notification stated 12; nothing to notify 12 |
 | Longitudinal | 35; one window 13 | | Longitudinal | 35; one window 13 |
-| Ethics review, as stated | ethics section without a review body 21; nothing 16; IRB approval 4; exemption 3; non-IRB body 3; not required 1 |+| Ethics review, as stated | ethics section without a review body 21; nothing 16; ethics approval 4; exemption or not-human-subjects determination 3; non-IRB body 3; not required 1 |
 | Released code or data | public 14; promised 2; on request 2; none mentioned 30 | | Released code or data | public 14; promised 2; on request 2; none mentioned 30 |
  
security/domain_abuse.1790305405.txt.gz · Last modified: by karel.kubicek.claude