More Web Proxy on the site http://driver.im/

research-article

Cybercrime After the Sunrise: A Statistical Analysis of DNS Abuse in New gTLDs

Authors:

Maciej Korczynski,

Maarten Wullink,

Samaneh Tajalizadehkhoob,

Giovane C. M. Moura,

Arman Noroozian,

Cristian HesselmanAuthors Info & Claims

ASIACCS '18: Proceedings of the 2018 on Asia Conference on Computer and Communications Security

Pages 609 - 623

https://doi.org/10.1145/3196494.3196548

Published: 29 May 2018 Publication History

Abstract

To enhance competition and choice in the domain name system, ICANN introduced the new gTLD program, which added hundreds of new gTLDs (e.g. .nyc, .io) to the root DNS zone. While the program arguably increased the range of domain names available to consumers, it might also have created new opportunities for cybercriminals. To investigate that, we present the first comparative study of abuse in the domains registered under the new gTLD program and legacy gTLDs (18 in total, such as .com, .org). We combine historical datasets from various sources, including DNS zone files, WHOIS records, passive and active DNS and HTTP measurements, and 11 reputable abuse feeds to study abuse across gTLDs. We find that the new gTLDs appear to have diverted abuse from the legacy gTLDs: while the total number of domains abused for spam remains stable across gTLDs, we observe a growing number of spam domains in new gTLDs which suggests a shift from legacy gTLDs to new gTLDs. Although legacy gTLDs had a rate of 56.9 spam domains per 10,000 registrations (Q4 2016), new gTLDs experienced a rate of 526.6 in the same period-which is almost one order of magnitude higher. In this study, we also analyze the relationship between DNS abuse, operator security indicators and the structural properties of new gTLDs. The results indicate that there is an inverse correlation between abuse and stricter registration policies. Our findings suggest that cybercriminals increasingly prefer to register, rather than hack, domain names and some new gTLDs have become a magnet for malicious actors. ICANN is currently using these results to review the existing anti-abuse safeguards, evaluate their joint effects and to introduce more effective safeguards before an upcoming new gTLD rollout.

References

[1]

G. Aaron and R. Rasmussen. 2016. Global Phishing Survey: Trends and Domain Name Use in 2016. http://docs.apwg.org/reports/APWG_Global_Phishing_ Report_2015--2016.pdf. (2016).

[2]

P. Agten, W. Joosen, F. Piessens, and N. Nikiforakis. 2015. Seven Months' Worth of Mistakes: A Longitudinal Study of Typosquatting Abuse. In Proc. of NDSS.

[3]

APWG. 2017. APWG: Cross-industry Global Group Supporting Tackling the Phishing Menace. http://antiphishing.org. (2017).

[4]

L. Bilge, E. Kirda, C. Kruegel, and M. Balduzzi. 2011. EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis. In Proc. of NDSS'11.

[5]

D. Chiba, T. Yagi, M. Akiyama, T. Shibahara, T. Mori, and S. Goto. 2017. DomainProfiler: toward accurate and early discovery of domain names abused in future. International Journal of Information Security (2017), 1--20.

[6]

CleanMX. 2017. Spam-Filter Anti-Spam Virenschutz. http://clean-mx.de. (2017).

[7]

Consumer Trust Competition and Consumer Choice (CCT). 2017. New Sections. Technical Report. https://www.icann.org/en/system/files/files/ cct-rt-draft-recs-new-sections-27nov17-en.pdf

[8]

D. Dagon, N Provos, C. P. Lee, and W. Lee. 2008. Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority. In Proc. of NDSS.

[9]

The Secure Domain Foundation. 2017. https://securedomain.org/. (2017).

[10]

T. Halvorson, M. F. Der, I. Foster, S. Savage, L. K. Saul, and G. M. Voelker. 2015. From .Academy to .Zone: An Analysis of the New TLD Land Rush. In IMC.

Digital Library

[11]

S. Hansmann. 2017. ICANN: Notice of Termination of Accreditation Agreement. https://www.icann.org/uploads/compliance_notice/attachment/895/ serad-to-hansmann-4jan17.pdf. (2017).

[12]

S. Hao, N. Feamster, and R. Pandrangi. 2011. Monitoring the initial DNS behavior of malicious domains. In Proc. of the IMC. ACM, 269--278.

Digital Library

[13]

S. Hao, M. Thomas, N. Paxson, V.and Feamster, C. Kreibich, C. Grier, and S. Hollenbeck. 2013. Understanding the Domain Registration Behavior of Spammers. In Proc. of IMC'13. ACM, 63--76.

Digital Library

[14]

IANA. 2017. IANA: Registrar IDs. https://www.iana.org/assignments/ registrar-ids/registrar-ids.xhtml. (2017).

[15]

ICANN. 2009. New gTLD Program Explanatory Memorandum: Mitigating Malicious Conduct. https://archive.icann.org/en/topics/new-gtlds/ mitigating-malicious-conduct-04oct09-en.pdf. (October 2009).

[16]

ICANN. 2013. Registrar Accreditation Agreement. (2013). https://www.icann. org/resources/pages/approved-with-specs-2013-09--17-en#whois-accuracy

[17]

ICANN. 2015. .madrid. https://icannwiki.org/.madrid. (March 2015).

[18]

ICANN. 2016. New gTLD Program Safeguards Against DNS Abuse. https://newgtlds.icann.org/en/reviews/dns-abuse/ safeguards-against-dns-abuse-18jul16-en.pdf. (2016).

[19]

ICANN. 2017. ICANN: .zuerich TLD. https://icannwiki.org/.zuerich. (2017).

[20]

ICANN. 2017. Internet Corporation for Assigned Names and Numbers (ICANN). https://www.icann.org. (2017).

[21]

ICANN. 2017. Monthly Registry Reports. https://www.icann.org/resources/ pages/registry-reports. (2017).

[22]

ICANN. 2017. New gTLD Program. icannwiki.com/New_gTLD_Program. (2017).

[23]

ICANN. 2017. TLD Startup Information. https://newgtlds.icann.org/en/ program-status/sunrise-claims-periods. (Retrieved on February 2017).

[24]

I. Khalil, T. Yu, and B. Guan. 2016. Discovering malicious domains through passive DNS data graph analysis. In Proc. of the ASIACCS. ACM, 663--674.

Digital Library

[25]

M. Korczy'ski, M. Król, and M. van Eeten. 2016. Zone Poisoning: The How and Where of Non-Secure DNS Dynamic Updates. In Proc. of the IMC. ACM, 271--278.

Digital Library

[26]

M. Korczy'ski, S. Tajalizadehkhoob, A. Noroozian, M. Wullink, C. Hesselman, and M. van Eeten. 2017. Reputation Metrics Design to Improve Intermediary Incentives for Security of TLDs. In Proc. of IEEE Euro SP.

[27]

M. Korczy'ski, M. Wullink, S. Tajalizadehkhoob, G. C. M. Moura, and C. Hesselman. 2017. Statistical Analysis of DNS Abuse in gTLDs Final Report. Technical Report. https://www.icann.org/en/system/files/files/sadag-final-09aug17-en.pdf

[28]

National Physical Laboratory. 2013. A Study of Whois Privacy and Proxy Service Abuse. gnso.icann.org/en/issues/whois/pp-abuse-study-20sep13-en.pdf. (2013).

[29]

T. Lauinger, Ka. Onarlioglu, A. Chaabane, W. Robertson, and E. Kirda. 2016. WHOIS Lost in Translation:(Mis) Understanding Domain Name Expiration and Re-Registration. In Proc. of the IMC. ACM, 247--253.

Digital Library

[30]

C. Lever, R. Walls, Y. Nadji, D. Dagon, P. McDaniel, and M. Antonakakis. 2016. Domain-Z: 28 registrations later measuring the exploitation of residual trust in domains. In Proc. of the IEEE S&P. IEEE, 691--706.

[31]

H. Liu, K. Levchenko, M. Felegyhazi, C. Kreibich, G. Maier, G. Voelker, and S. Savage. 2011. On the Effects of Registrar-level Intervention. USENIX LEET (2011).

Digital Library

[32]

S. Liu, I. Foster, S. Savage, G. M. Voelker, and L. K. Saul. 2015. Who is. com?: Learning to parse whois records. In Proc. of the IMC. ACM, 369--380.

Digital Library

[33]

P.V. Mockapetris. 1987. Domain names - concepts and facilities. RFC 1034. (1987).

Digital Library

[34]

A. Noroozian, M. Ciere, M. Korczy'ski, S. Tajalizadehkhoob, and M. Eeten. 2017. Inferring the Security Performance of Providers from Noisy and Heterogenous Abuse Datasets. In WEIS 2017.

[35]

A. Noroozian, M. Korczy'ski, S. Tajalizadehkhoob, and M. van Eeten. 2015. Developing Security Reputation Metrics for Hosting Providers. In USENIX CSET.

Digital Library

[36]

J. Postel and J.K. Reynolds. 1984. Domain requirements. RFC 920. RFC Editor.

Digital Library

[37]

SBW. 2017. StopBadware: DSP. www.stopbadware.org/data-sharing. (2017).

[38]

H. Shulman and M. Waidner. 2015. Towards security of internet naming infrastructure. In Proc. of the ESORICS. Springer, 3--22.

Digital Library

[39]

K. Soska and N. Christin. 2014. Automatically detecting vulnerable websites before they turn malicious. In Proc. USENIX Security.

Digital Library

[40]

Spamhaus. 2017. The Domain Block List. https://www.spamhaus.org/dbl. (2017).

[41]

Spamhaus. 2017. The Spamhaus Project. www.spamhaus.org. (2017).

[42]

B. Stone-Gross, C. Kruegel, K. Almeroth, A. Moser, and E. Kirda. 2009. FIRE: FInding Rogue nEtworks. In Proc. of the ACSAC. IEEE Computer Society, 231--240.

Digital Library

[43]

StopBadware. 2017. StopBadware: A Nonprofit Anti-malware Organization. https://www.stopbadware.org. (2017).

[44]

SURBL. 2017. SURBL - URI reputation data. http://www.surbl.org. (2017).

[45]

SURBL. 2017. SURBL Lists. http://www.surbl.org/lists. (2017).

[46]

J. Szurdi, B. Kocso, G. Cseh, J. Spring, M. Felegyhazi, and C. Kanich. 2014. The Long" Taile" of Typosquatting Domain Names. In Proc. of USENIX Security.

Digital Library

[47]

S. Tajalizadehkhoob, R. Böhme, C. Gañán, M. Korczy'ski, and M. van Eeten. 2018. Rotten Apples or Bad Harvest? What We Are Measuring When We Are Measuring Abuse. IEEE TOIT (2018). https://arxiv.org/abs/1702.01624

[48]

S. Tajalizadehkhoob, T. Van Goethem, M. Korczy'ski, A. Noroozian, R. Böhme, T. Moore, W. Joosen, and M. van Eeten. 2017. Herding Vulnerable Cats: A Statistical Approach to Disentangle Joint Responsibility for Web Security in Shared Hosting. In Proc. of the ACM CCS.

Digital Library

[49]

Domain Tools. 2017. DomainTools: Domain Whois Lookup, Whois API &DNS Data Research. http://www.domaintools.com. (2017).

[50]

T. Vissers, W. Joosen, and N. Nikiforakis. 2015. Parking Sensors: Analyzing and Detecting Parked Domains. In Proc. of NDSS.

[51]

T. Vissers, J. Spooren, P. Agten, D. Jumpertz, P. Janssen, M. Van Wesemael, F. Piessens, W. Joosen, and L. Desmet. 2017. Exploring the Ecosystem of Malicious Domain Registrations in the .eu TLD. In Proc. of the RAID. Springer, 472--493.

[52]

WhoisXML. 2017. Whois XML API. https://www.whoisxmlapi.com/. (2017).

Cited By

Korczyński MNoroozian A(2025)Security Reputation MetricsEncyclopedia of Cryptography, Security and Privacy10.1007/978-3-030-71522-9_1625(2335-2340)Online publication date: 8-Jan-2025
https://doi.org/10.1007/978-3-030-71522-9_1625
Sommese RAkiwate GAffinito AMuller MJonker Mclaffy kVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)DarkDNS: Revisiting the Value of Rapid Zone UpdateProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3689021(454-461)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3689021
Anderson AMondal ABarford PCrovella MSommers J(2024)An Elemental Decomposition of DNS Name-to-IP GraphsIEEE INFOCOM 2024 - IEEE Conference on Computer Communications10.1109/INFOCOM52122.2024.10621147(1661-1670)Online publication date: 20-May-2024
https://doi.org/10.1109/INFOCOM52122.2024.10621147
Show More Cited By

Index Terms

Cybercrime After the Sunrise: A Statistical Analysis of DNS Abuse in New gTLDs
1. Security and privacy

Recommendations

A Survey on Malicious Domains Detection through DNS Data Analysis

Malicious domains are one of the major resources required for adversaries to run attacks over the Internet. Due to the important role of the Domain Name System (DNS), extensive research has been conducted to identify malicious domains based on their ...
From .academy to .zone: An Analysis of the New TLD Land Rush
IMC '15: Proceedings of the 2015 Internet Measurement Conference

The com, net, and org TLDs contain roughly 150 million registered domains, and domain registrants often have a difficult time finding a desirable and available name. In 2013, ICANN began delegation of a new wave of TLDs into the Domain Name System with ...
ICANN's TLD Plans Are Defined, Not Yet Refined

The ICANN board of directors' recent decisions to greatly expand the number of generic Top-Level Domains (gTLDs) and fast-track some country-code TLDs (ccTLDs) using internationalized characters illustrates that ICANN has stumbled into a quagmire; that ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Conferences

ASIACCS '18: Proceedings of the 2018 on Asia Conference on Computer and Communications Security

May 2018

866 pages

ISBN:9781450355766

DOI:10.1145/3196494

General Chairs:
Jong Kim
Pohang University of Science and Technology, South Korea
,
Gail-Joon Ahn
Arizona State University, USA &Samsung Electronics, South Korea
,
Seungjoo Kim
Korea University, South Korea
,
Program Chairs:
Yongdae Kim
KAIST, South Korea
,
Javier Lopez
University of Malaga, Spain
,
Taesoo Kim
Georgia Tech, USA

Copyright © 2018 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 29 May 2018

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

ICANN
French Ministry of Research project PERSYVAL-Lab

Conference

ASIA CCS '18

Sponsor:

SIGSAC

ASIA CCS '18: ACM Asia Conference on Computer and Communications Security

June 4, 2018

Incheon, Republic of Korea

Acceptance Rates

ASIACCS '18 Paper Acceptance Rate 52 of 310 submissions, 17%;

Overall Acceptance Rate 418 of 2,322 submissions, 18%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

28
Total Citations
View Citations
424
Total Downloads

Downloads (Last 12 months)43
Downloads (Last 6 weeks)5

Reflects downloads up to 02 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Korczyński MNoroozian A(2025)Security Reputation MetricsEncyclopedia of Cryptography, Security and Privacy10.1007/978-3-030-71522-9_1625(2335-2340)Online publication date: 8-Jan-2025
https://doi.org/10.1007/978-3-030-71522-9_1625
Sommese RAkiwate GAffinito AMuller MJonker Mclaffy kVallina-Rodríguez NSuarez-Tángil GLevin DPelsser C(2024)DarkDNS: Revisiting the Value of Rapid Zone UpdateProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3689021(454-461)Online publication date: 4-Nov-2024
https://dl.acm.org/doi/10.1145/3646547.3689021
Anderson AMondal ABarford PCrovella MSommers J(2024)An Elemental Decomposition of DNS Name-to-IP GraphsIEEE INFOCOM 2024 - IEEE Conference on Computer Communications10.1109/INFOCOM52122.2024.10621147(1661-1670)Online publication date: 20-May-2024
https://doi.org/10.1109/INFOCOM52122.2024.10621147
Aravena LCasas PBustos-Jiménez JCapdehourat GFindrik M(2024)DeepD2V - Deep Learning and Domain Word Embeddings for DGA based Malware Detection2024 IEEE International Conference on Machine Learning for Communication and Networking (ICMLCN)10.1109/ICMLCN59089.2024.10624693(164-170)Online publication date: 5-May-2024
https://doi.org/10.1109/ICMLCN59089.2024.10624693
Haider RAslam BAbbas HIqbal Z(2024)C2-DNSWatch: Endpoint Framework for Detecting Command and Control (C2) Connection of Advanced Persistent Threats (APTs)2024 13th International Conference on Communications, Circuits and Systems (ICCCAS)10.1109/ICCCAS62034.2024.10652798(64-69)Online publication date: 10-May-2024
https://doi.org/10.1109/ICCCAS62034.2024.10652798
Kawaoka RChiba DWatanabe TAkiyama MMori T(2024)Longitudinal Measurement Study of the Domain Names Associated With the Olympic GamesIEEE Access10.1109/ACCESS.2024.336010812(19128-19144)Online publication date: 2024
https://doi.org/10.1109/ACCESS.2024.3360108
Aguerre C(2024)The legacies of long tail and the unfolding of consolidation and concentration in the top-level domain sectorJournal of Cyber Policy10.1080/23738871.2023.22900578:2(218-238)Online publication date: 2-Jan-2024
https://doi.org/10.1080/23738871.2023.2290057
Haider RAslam BAbbas HIqbal Z(2024)C2-Eye: framework for detecting command and control (C2) connection of supply chain attacksInternational Journal of Information Security10.1007/s10207-024-00850-y23:4(2531-2545)Online publication date: 1-Aug-2024
https://dl.acm.org/doi/10.1007/s10207-024-00850-y
Aravena LCasas PBustos-Jiménez JCapdehourat GFindrik M(2023)Not all DGAs are Born the Same – Improving Lexicographic based Detection of DGA Domains through AI/ML2023 7th Network Traffic Measurement and Analysis Conference (TMA)10.23919/TMA58422.2023.10198918(1-4)Online publication date: 26-Jun-2023
https://doi.org/10.23919/TMA58422.2023.10198918
Aravena LCasas PBustos-Jiménez JCapdehourat GFindrik M(2023)Dom2Vec - Detecting DGA Domains Through Word Embeddings and AI/ML-Driven Lexicographic Analysis2023 19th International Conference on Network and Service Management (CNSM)10.23919/CNSM59352.2023.10327913(1-5)Online publication date: 30-Oct-2023
https://doi.org/10.23919/CNSM59352.2023.10327913
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten