TLS Certificate and Domain Feature Analysis of Phishing Domains in the Danish .dk Namespace

• URL: http://arxiv.org/abs/2603.21652v1
• Date: Mon, 23 Mar 2026 07:30:05 GMT
• Title: TLS Certificate and Domain Feature Analysis of Phishing Domains in the Danish .dk Namespace
• Abstract summary: Phishing attacks remain a persistent cybersecurity threat.<n>This study examines whether certificate metadata and domain characteristics can help distinguish phishing domains from benign domains within the Danish.dk.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Phishing attacks remain a persistent cybersecurity threat, and the widespread adoption of TLS certificates has unintentionally enabled malicious websites to appear trustworthy to users. This study examines whether certificate metadata and domain characteristics can help distinguish phishing domains from benign domains within the Danish .dk namespace. A dataset was constructed by combining registry information from Punktum dk with phishing reports and popularity rankings from external sources. TLS certificate attributes were collected using Netlas, while additional domain-based features were derived from DNS records and lexical analysis of domain names. The analysis compares phishing, popular, and less frequently visited domains across several feature categories, including Certificate Authorities (CAs), validity periods, missing certificate fields, SAN structure, registrant geography, hosting providers, and lexical properties of domain names. The results indicate that several features show observable differences between phishing and highly popular domains. However, phishing domains often resemble less popular domains, resulting in substantial overlap across many characteristics. Consequently, no individual feature provides a reliable standalone indicator of phishing activity within the Danish namespace. The findings suggest that certificate and domain attributes may still contribute to detection when combined, while also highlighting the limitations of relying on individual indicators in isolation. This work provides an empirical overview of phishing-related infrastructure patterns in the Danish .dk ecosystem and offers insights that may inform future phishing detection approaches.

Related papers

• PhiShark2026: A Multi-Layer Active-Web Raw-Evidence Dataset for Phishing Website Research [39.146761527401424]
  Phishing websites are short-lived and rapidly changing, yet many phishing datasets reduce observations to URLs or precomputed features.<n>This study addresses this limitation with a multi-layer active-web dataset comprising 67,502 scans, including 33,387 phishing observations from operational feeds and 34,115 screened benign reference observations.<n>The corpus preserves raw evidence across HTML content and screenshots, URL and redirect behavior, HTTP and security headers, compliance files, TLS certificates, DNS and domain registration, open ports, geolocation and accessibility measurements, and network infrastructure.
  arXiv  Detail & Related papers  (2026-08-24T12:50:12Z)
• A Longitudinal Study of Recently Observed Malicious Domains: Characteristics, Infrastructure, and Abuse Patterns [2.949222434075052]
  We group the dataset into compromised domains and attacker created domains.<n>Majority of attacker created domains are short lived registrations used within weeks of creation.<n>Bulk registration events involving thousands of domains from a single registrar are widespread.
  arXiv  Detail & Related papers  (2026-06-09T17:06:58Z)
• Shh, don't say that! Domain Certification in LLMs [124.61851324874627]
  Large language models (LLMs) are often deployed to perform constrained tasks, with narrow domains.<n>We introduce domain certification; a guarantee that accurately characterizes the out-of-domain behavior of language models.<n>We then propose a simple yet effective approach, which we call VALID that provides adversarial bounds as a certificate.
  arXiv  Detail & Related papers  (2025-02-26T17:13:19Z)
• SNaRe: Domain-aware Data Generation for Low-Resource Event Detection [77.32937742071475]
  Event Detection is critical for enabling reasoning in highly specialized domains such as biomedicine, law, and epidemiology.<n>We introduce SNaRe, a domain-aware synthetic data generation framework composed of three components: Scout, Narrator, and Refiner.<n>Scout extracts triggers from unlabeled target domain data and curates a high-quality domain-specific trigger list.<n>Narrator, conditioned on these triggers, generates high-quality domain-aligned sentences, and Refiner identifies additional event mentions.
  arXiv  Detail & Related papers  (2025-02-24T18:20:42Z)
• Registration, Detection, and Deregistration: Analyzing DNS Abuse for Phishing Attacks [2.160481692907504]
  Phishing continues to pose a significant cybersecurity threat.<n>It is essential to address this fundamental challenge at the root, particularly in phishing domains.<n> Domain registration presents a crucial intervention point, as domains serve as the primary gateway between users and websites.
  arXiv  Detail & Related papers  (2025-02-13T18:02:48Z)
• DomURLs_BERT: Pre-trained BERT-based Model for Malicious Domains and URLs Detection and Classification [4.585051136007553]
  We introduce DomURLs_BERT, a pre-trained BERT-based encoder for detecting and classifying suspicious/malicious domains and URLs. The proposed encoder outperforms state-of-the-art character-based deep learning models and cybersecurity-focused BERT models across multiple tasks and datasets.
  arXiv  Detail & Related papers  (2024-09-13T18:59:13Z)
• PhishReplicant: A Language Model-based Approach to Detect Generated Squatting Domain Names [2.3999111269325266]
  Domain squatting is a technique used by attackers to create domain names for phishing sites. We propose a system called PhishReplicant that detects generated squatting domains (GSDs) by focusing on the linguistic similarity of domain names.
  arXiv  Detail & Related papers  (2023-10-18T07:41:41Z)
• Model Barrier: A Compact Un-Transferable Isolation Domain for Model Intellectual Property Protection [52.08301776698373]
  We propose a novel approach called Compact Un-Transferable Isolation Domain (CUTI-domain) CUTI-domain acts as a barrier to block illegal transfers from authorized to unauthorized domains. We show that CUTI-domain can be easily implemented as a plug-and-play module with different backbones.
  arXiv  Detail & Related papers  (2023-03-20T13:07:11Z)
• Domain Invariant Masked Autoencoders for Self-supervised Learning from Multi-domains [73.54897096088149]
  We propose a Domain-invariant Masked AutoEncoder (DiMAE) for self-supervised learning from multi-domains. The core idea is to augment the input image with style noise from different domains and then reconstruct the image from the embedding of the augmented image. Experiments on PACS and DomainNet illustrate that DiMAE achieves considerable gains compared with recent state-of-the-art methods.
  arXiv  Detail & Related papers  (2022-05-10T09:49:40Z)
• Domain-Agnostic Prior for Transfer Semantic Segmentation [197.9378107222422]
  Unsupervised domain adaptation (UDA) is an important topic in the computer vision community. We present a mechanism that regularizes cross-domain representation learning with a domain-agnostic prior (DAP) Our research reveals that UDA benefits much from better proxies, possibly from other data modalities.
  arXiv  Detail & Related papers  (2022-04-06T09:13:25Z)
• DNS Typo-squatting Domain Detection: A Data Analytics & Machine Learning Based Approach [9.006364242523249]
  Domain Name System (DNS) is a crucial component of current IP-based networks as it is the standard mechanism for name to IP resolution. Detecting this attack is particularly important as it can be a threat to corporate secrets and can be used to steal information or commit fraud. In this paper, a machine learning-based approach is proposed to tackle the typosquatting vulnerability.
  arXiv  Detail & Related papers  (2020-12-25T16:51:30Z)
• Domain Agnostic Learning for Unbiased Authentication [47.85174796247398]
  We propose a domain-agnostic method that eliminates domain-difference without domain labels. latent domains are discovered by learning the heterogeneous predictive relationships between inputs and outputs. We extend our method to a meta-learning framework to pursue more thorough domain-difference elimination.
  arXiv  Detail & Related papers  (2020-10-11T14:05:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.