INFERMAL: Inferential analysis of maliciously registered domains

• URL: http://arxiv.org/abs/2512.01391v1
• Date: Mon, 01 Dec 2025 08:10:01 GMT
• Title: INFERMAL: Inferential analysis of maliciously registered domains
• Abstract summary: Previous work revealed an abnormally high concentration of malicious registrations in a handful of domain name registrars and top-level domains.<n>Anecdotal evidence suggests that low registration prices attract cybercriminals, implying that higher costs may potentially discourage them.<n>In this report, we carefully distill the inclinations and aversions of malicious actors during the registration of new phishing domain names.<n>Through a GLM regression analysis, we find that each dollar reduction in registration fees corresponds to a 49% increase in malicious domains.
• Score: 1.8283547689209836
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Cybercriminals have long depended on domain names for phishing, spam, malware distribution, and botnet operation. To facilitate the malicious activities, they continually register new domain names for exploitation. Previous work revealed an abnormally high concentration of malicious registrations in a handful of domain name registrars and top-level domains (TLDs). Anecdotal evidence suggests that low registration prices attract cybercriminals, implying that higher costs may potentially discourage them. However, no existing study has systematically analyzed the factors driving abuse, leaving a critical gap in understanding how different variables influence malicious registrations. In this report, we carefully distill the inclinations and aversions of malicious actors during the registration of new phishing domain names. We compile a comprehensive list of 73 features encompassing three main latent factors: registration attributes, proactive verification, and reactive security practices. Through a GLM regression analysis, we find that each dollar reduction in registration fees corresponds to a 49% increase in malicious domains. The availability of free services, such as web hosting, drives an 88% surge in phishing activities. Conversely, stringent restrictions cut down abuse by 63%, while registrars providing API access for domain registration or account creation experience a staggering 401% rise in malicious domains. This exploration may assist intermediaries involved in domain registration to develop tailored anti-abuse practices, yet aligning them with their economic incentives.

Related papers

• A Longitudinal Study of Recently Observed Malicious Domains: Characteristics, Infrastructure, and Abuse Patterns [2.949222434075052]
  We group the dataset into compromised domains and attacker created domains.<n>Majority of attacker created domains are short lived registrations used within weeks of creation.<n>Bulk registration events involving thousands of domains from a single registrar are widespread.
  arXiv  Detail & Related papers  (2026-06-09T17:06:58Z)
• Domijn: The Security of Domain Registrars and the Risk of a Domain Name Takeover [0.5833117322405447]
  In this paper we empirically study how registrars implement security controls to prevent against such takeovers.<n>We focus on the top 10 most popular registrars for the.nl ccTLD.<n>We find that all registrars in our study implement relatively effective security measures, but that they fall short in more advanced security controls.
  arXiv  Detail & Related papers  (2026-05-20T10:14:21Z)
• Infrastructure Patterns in Toll Scam Domains: A Comprehensive Analysis of Cybercriminal Registration and Hosting Strategies [3.964670382779565]
  Toll scams involve criminals registering fake domains that pretend to be legitimate transportation agencies.<n>We present the first large-scale analysis of toll scam domains using a newly created dataset of 67,907 confirmed scam domains.
  arXiv  Detail & Related papers  (2025-10-16T01:09:30Z)
• WebGuard: Building a Generalizable Guardrail for Web Agents [59.31116061613742]
  WebGuard is the first dataset designed to support the assessment of web agent action risks.<n>It contains 4,939 human-annotated actions from 193 websites across 22 diverse domains.
  arXiv  Detail & Related papers  (2025-07-18T18:06:27Z)
• Shh, don't say that! Domain Certification in LLMs [124.61851324874627]
  Large language models (LLMs) are often deployed to perform constrained tasks, with narrow domains.<n>We introduce domain certification; a guarantee that accurately characterizes the out-of-domain behavior of language models.<n>We then propose a simple yet effective approach, which we call VALID that provides adversarial bounds as a certificate.
  arXiv  Detail & Related papers  (2025-02-26T17:13:19Z)
• SNaRe: Domain-aware Data Generation for Low-Resource Event Detection [77.32937742071475]
  Event Detection is critical for enabling reasoning in highly specialized domains such as biomedicine, law, and epidemiology.<n>We introduce SNaRe, a domain-aware synthetic data generation framework composed of three components: Scout, Narrator, and Refiner.<n>Scout extracts triggers from unlabeled target domain data and curates a high-quality domain-specific trigger list.<n>Narrator, conditioned on these triggers, generates high-quality domain-aligned sentences, and Refiner identifies additional event mentions.
  arXiv  Detail & Related papers  (2025-02-24T18:20:42Z)
• Registration, Detection, and Deregistration: Analyzing DNS Abuse for Phishing Attacks [2.160481692907504]
  Phishing continues to pose a significant cybersecurity threat.<n>It is essential to address this fundamental challenge at the root, particularly in phishing domains.<n> Domain registration presents a crucial intervention point, as domains serve as the primary gateway between users and websites.
  arXiv  Detail & Related papers  (2025-02-13T18:02:48Z)
• DomainDynamics: Lifecycle-Aware Risk Timeline Construction for Domain Names [2.6217304977339473]
  DomainDynamics is a novel system designed to predict domain name risks by considering their lifecycle stages.<n>In an experiment involving over 85,000 actual malicious domains from malware and phishing incidents, DomainDynamics achieved an 82.58% detection rate with a low false positive rate of 0.41%.
  arXiv  Detail & Related papers  (2024-10-02T23:33:13Z)
• Say No to Freeloader: Protecting Intellectual Property of Your Deep Model [52.783709712318405]
  Compact Un-transferable Pyramid Isolation Domain (CUPI-Domain) serves as a barrier against illegal transfers from authorized to unauthorized domains. We propose CUPI-Domain generators, which select features from both authorized and CUPI-Domain as anchors. We provide two solutions for utilizing CUPI-Domain based on whether the unauthorized domain is known.
  arXiv  Detail & Related papers  (2024-08-23T15:34:33Z)
• Don't Get Hijacked: Prevalence, Mitigation, and Impact of Non-Secure DNS Dynamic Updates [1.135267457536642]
  DNS dynamic updates represent an inherently vulnerable mechanism. Non-secure DNS updates leave domains susceptible to a novel form of attack termed zone poisoning. We undertook a comprehensive campaign involving the notification of Computer Security Incident Response Teams.
  arXiv  Detail & Related papers  (2024-05-30T09:23:53Z)
• PhishReplicant: A Language Model-based Approach to Detect Generated Squatting Domain Names [2.3999111269325266]
  Domain squatting is a technique used by attackers to create domain names for phishing sites. We propose a system called PhishReplicant that detects generated squatting domains (GSDs) by focusing on the linguistic similarity of domain names.
  arXiv  Detail & Related papers  (2023-10-18T07:41:41Z)
• Model Barrier: A Compact Un-Transferable Isolation Domain for Model Intellectual Property Protection [52.08301776698373]
  We propose a novel approach called Compact Un-Transferable Isolation Domain (CUTI-domain) CUTI-domain acts as a barrier to block illegal transfers from authorized to unauthorized domains. We show that CUTI-domain can be easily implemented as a plug-and-play module with different backbones.
  arXiv  Detail & Related papers  (2023-03-20T13:07:11Z)
• Domain Agnostic Learning for Unbiased Authentication [47.85174796247398]
  We propose a domain-agnostic method that eliminates domain-difference without domain labels. latent domains are discovered by learning the heterogeneous predictive relationships between inputs and outputs. We extend our method to a meta-learning framework to pursue more thorough domain-difference elimination.
  arXiv  Detail & Related papers  (2020-10-11T14:05:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.