Detecting and Preventing Malicious Domain Registrations in the .eu TLD

on YouTube ↗43m

" summary

Fourteen months of .eu registrations yield 824,121 registrations with 2.53% flagged by blacklists and at least 80.04% of short‑lived malicious names grouping into about 20 campaigns. Clustering and heuristics use registrant fields, registrar, nameserver and glue records plus ML to reveal bulk hit‑and‑run behavior and human work patterns. A production classifier running at EURid already blocks many registrations at intake with ~80% recall and only about one to five false positives per day as it delays activation for extra verification.

AI-written summary · about

" chapters (48)

1. 0:00Introduction
2. 1:08Malicious Domain Names
3. 2:15Research Hypothesis
4. 3:32Outline
5. 4:45Domain Registrations
6. 5:17Malicious Domains
7. 5:30Registration Data
8. 6:08Bootstrap IP Address
9. 7:14Campaign Identification
10. 9:33How did they operate
11. 10:07What did we explore
12. 13:30Is it obvious that the registration will be malicious
13. 14:30What can we do
14. 15:20Other organizations preventing
15. 15:44Manual vs automated analysis
16. 16:53Campaign criteria
17. 17:42The ecosystem of domain registrations
18. 18:41The insights we found
19. 18:57The window of opportunity
20. 19:35What is the reason why
21. 20:53Which blacklist did we use
22. 21:34Data summary
23. 22:26Campaigns with links
24. 23:38Relations between campaigns
25. 24:32Clustering
26. 25:26Automation
27. 27:27Demand and offer questions
28. 28:55facilitators
29. 29:14toxicity
30. 29:41good API
31. 30:12email
32. 31:26campaigns vs black lists
33. 32:23prevention detection
34. 33:17Spamhaus
35. 33:32Prevention and detection
36. 34:39Prediction models
37. 35:07Current operation
38. 35:42Domain seizures
39. 36:16Blacklist
40. 36:47Key takeaways
41. 36:59The facilitators
42. 37:15The second takeaway
43. 38:07Productive detection and prevention
44. 38:41How will the catandmouse game kill
45. 39:03Compliance
46. 39:38TLD Ecosystem
47. 40:28Europe
48. 42:25Thank you

" related talks

• 46mExploring the ecosystem of malicious domain registrations in the .eu TLDLieven Desmet · OWASP BeNeLux Day 2017
• 40mCritical DNS & Domain Name Security Intelligence to Thwart CyberattacksIhab Shraim, David Conrad · RSAC 2021
• 35mA Comprehensive Measurement Study of Domain Generating MalwareJohannes Bader, Daniel Plohmann, Khaled Yakdan, Michael Klatt, Elmar Gerhards-Padilla · USENIX Security '16
• 35mGame of Registrars...Tobias Lauinger, Abdelberi Chaabane, Ahmet Salih Buyukkayhan, Kaan Onarlioglu, William Robertson · 26th USENIX Security Symposium (USENIX Security '17)
• 40mDeleting Your Domain? Preventing Data Leaks at TLD ScaleMaarten Wullink · Black Hat Europe 2023
• 16mhijacking.gov.uk - Identifying and Communicating Risks to the Digital StateTerence Eden · Global Security Vulnerability Summit @ Open Source Summit North America 2022
• 43mBenchmarking Your Constituency: A Practical Framework for CERTs with Results from Academic SectorJuha Haaga · FIRST Conference 2026 (FIRSTCON26)
• 59mCatching Malware En Masse: DNS and IP StyleDhia Mahjoub, Thibault Reuille, Andree Toonk · Black Hat USA 2014