Exploring the ecosystem of malicious domain registrations in the .eu TLD
summary
Analysis covers 14 months and 824,121 registrations and finds 2.53% flagged by Spamhaus Google Safe Browsing and SURBL using ~700,000 DNS queries and MaxMind geolocation. It groups malicious names into campaigns and reports 80.04% of short lived malicious domains fall into 20 campaigns, observes partial automation in fake registrant pools, uses agglomerative clustering and classifiers, and builds a prediction service that finds roughly 60–70% detected at registration with very low false positives and is being deployed in the .eu trust program.
AI-written summary · about
chapters (20)
- 0:00Malicious domain research in .eu TLD
- 1:46Malicious domain names and attacker strategies
- 3:53Data sources and methodology
- 6:41Defining malicious campaigns
- 9:34Campaign identification criteria
- 13:28Insights from 20 malicious campaigns
- 19:04Temporal patterns in registrations
- 22:34Business hours and automation
- 25:07Top facilitators of malicious registrations
- 27:15Campaign overlap with blacklists
- 29:00Adaptive strategies of actors
- 30:43Automating campaign identification
- 33:59Validating clustering results
- 37:37Manual vs automated detection
- 38:43Proactive detection at registration
- 39:46Key findings and conclusions
- 41:23Q&A on detection and limitations
- 42:45Focus on .eu TLD and domain shifting
- 44:10Leveraging classification tools
- 44:51Scope and future research
related talks
43mDetecting and Preventing Malicious Domain Registrations in the .eu TLD
35mA Comprehensive Measurement Study of Domain Generating Malware
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
28mFerris Bueller's Guide to Abuse Domain Permutations
30mDeception at Scale: How Malware Abuses Trust
59mCatching Malware En Masse: DNS and IP Style
16mhijacking.gov.uk - Identifying and Communicating Risks to the Digital State