The Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
summary
Built an infiltration account and a scanner that probes DNS and page-change patterns, then queries crawler logs; the system examines 30 million domains across 22 TLDs/SLDs, detects wildcard DNS abuse and ever-changing hyperlink sets, and flags roughly 400–458K recruited SEO domains (manual sample validation shows some false positives). Measured traps that cause thousands of crawler visits (15,000 on the test domain), found abuse of embedded searches on Amazon/Ebay, and after deployment with Baidu escalates to about 1.4 million SEO pages collected.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:21Search Engine Optimization(SEO)
- 1:57How does Spider Pool work?
- 4:00Infiltrating the Supper Spider Pool
- 9:19Spiders in ever-changing Labyrinth
- 10:43Tricks of spider pool
- 12:04Spider Pool Detection
- 17:05Sample Spider Pool Campaigns
- 17:32Customers of Spider Pools
- 20:57Summary
related talks
28mFerris Bueller's Guide to Abuse Domain Permutations
32mSomething’s Phishy: See the Hook Before the Bait
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
25mDark Side of the DNS Force
47mDNS On Fire
59mCatching Malware En Masse: DNS and IP Style
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware