Domijn: The Security of Domain Registrars and the Risk of a Domain Name Takeover

• URL: http://arxiv.org/abs/2605.20984v1
• Date: Wed, 20 May 2026 10:14:21 GMT
• Title: Domijn: The Security of Domain Registrars and the Risk of a Domain Name Takeover
• Abstract summary: In this paper we empirically study how registrars implement security controls to prevent against such takeovers.<n>We focus on the top 10 most popular registrars for the.nl ccTLD.<n>We find that all registrars in our study implement relatively effective security measures, but that they fall short in more advanced security controls.
• Score: 0.5833117322405447
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Domain names are key assets for organisation. They anchor an organisation's online presence and reputation, and serve as linking pin for web services and, e.g., email. Consequently, a malicious takeover of a domain can lead to significant damages. Organisations register domain names through so-called registrars, a type of business that plays a key role in the domain name industry. This implies that registrars play an important part in safeguarding against malicious takeovers of domains. In this paper we empirically study how registrars implement security controls to prevent against such takeovers. We focus on the top 10 most popular registrars for the .nl ccTLD. We present the results of this study in light of a model for the impact of domain takeovers, that analyses the possible consequence of a takeover. We contrast this against the impact of two other well-known threats: ransomware and DDoS attacks. We find that all registrars in our study implement relatively effective security measures, but that they fall short in more advanced security controls, such as the proper implementation of two-factor authentication. We also find that a domain takeover can have significant impact, potentially equalling that of a ransomware attack.

Related papers

• A Longitudinal Study of Recently Observed Malicious Domains: Characteristics, Infrastructure, and Abuse Patterns [2.949222434075052]
  We group the dataset into compromised domains and attacker created domains.<n>Majority of attacker created domains are short lived registrations used within weeks of creation.<n>Bulk registration events involving thousands of domains from a single registrar are widespread.
  arXiv  Detail & Related papers  (2026-06-09T17:06:58Z)
• INFERMAL: Inferential analysis of maliciously registered domains [1.8283547689209836]
  Previous work revealed an abnormally high concentration of malicious registrations in a handful of domain name registrars and top-level domains.<n>Anecdotal evidence suggests that low registration prices attract cybercriminals, implying that higher costs may potentially discourage them.<n>In this report, we carefully distill the inclinations and aversions of malicious actors during the registration of new phishing domain names.<n>Through a GLM regression analysis, we find that each dollar reduction in registration fees corresponds to a 49% increase in malicious domains.
  arXiv  Detail & Related papers  (2025-12-01T08:10:01Z)
• Infrastructure Patterns in Toll Scam Domains: A Comprehensive Analysis of Cybercriminal Registration and Hosting Strategies [3.964670382779565]
  Toll scams involve criminals registering fake domains that pretend to be legitimate transportation agencies.<n>We present the first large-scale analysis of toll scam domains using a newly created dataset of 67,907 confirmed scam domains.
  arXiv  Detail & Related papers  (2025-10-16T01:09:30Z)
• Registration, Detection, and Deregistration: Analyzing DNS Abuse for Phishing Attacks [2.160481692907504]
  Phishing continues to pose a significant cybersecurity threat.<n>It is essential to address this fundamental challenge at the root, particularly in phishing domains.<n> Domain registration presents a crucial intervention point, as domains serve as the primary gateway between users and websites.
  arXiv  Detail & Related papers  (2025-02-13T18:02:48Z)
• Say No to Freeloader: Protecting Intellectual Property of Your Deep Model [52.783709712318405]
  Compact Un-transferable Pyramid Isolation Domain (CUPI-Domain) serves as a barrier against illegal transfers from authorized to unauthorized domains. We propose CUPI-Domain generators, which select features from both authorized and CUPI-Domain as anchors. We provide two solutions for utilizing CUPI-Domain based on whether the unauthorized domain is known.
  arXiv  Detail & Related papers  (2024-08-23T15:34:33Z)
• Don't Get Hijacked: Prevalence, Mitigation, and Impact of Non-Secure DNS Dynamic Updates [1.135267457536642]
  DNS dynamic updates represent an inherently vulnerable mechanism. Non-secure DNS updates leave domains susceptible to a novel form of attack termed zone poisoning. We undertook a comprehensive campaign involving the notification of Computer Security Incident Response Teams.
  arXiv  Detail & Related papers  (2024-05-30T09:23:53Z)
• Model Barrier: A Compact Un-Transferable Isolation Domain for Model Intellectual Property Protection [52.08301776698373]
  We propose a novel approach called Compact Un-Transferable Isolation Domain (CUTI-domain) CUTI-domain acts as a barrier to block illegal transfers from authorized to unauthorized domains. We show that CUTI-domain can be easily implemented as a plug-and-play module with different backbones.
  arXiv  Detail & Related papers  (2023-03-20T13:07:11Z)
• Bridging the Source-to-target Gap for Cross-domain Person Re-Identification with Intermediate Domains [63.23373987549485]
  Cross-domain person re-identification (re-ID) aims to transfer the identity-discriminative knowledge from the source to the target domain. We propose an Intermediate Domain Module (IDM) and a Mirrors Generation Module (MGM) IDM generates multiple intermediate domains by mixing the hidden-layer features from source and target domains. MGM is introduced by mapping the features into the IDM-generated intermediate domains without changing their original identity.
  arXiv  Detail & Related papers  (2022-03-03T12:44:56Z)
• IDM: An Intermediate Domain Module for Domain Adaptive Person Re-ID [58.46907388691056]
  We argue that the bridging between the source and target domains can be utilized to tackle the UDA re-ID task. We propose an Intermediate Domain Module (IDM) to generate intermediate domains' representations on-the-fly. Our proposed method outperforms the state-of-the-arts by a large margin in all the common UDA re-ID tasks.
  arXiv  Detail & Related papers  (2021-08-05T07:19:46Z)
• Towards Corruption-Agnostic Robust Domain Adaptation [76.66523954277945]
  We investigate a new task, Corruption-agnostic Robust Domain Adaptation (CRDA): to be accurate on original data and robust against unavailable-for-training corruptions on target domains. We propose a new approach based on two technical insights into CRDA: 1) an easy-to-plug module called Domain Discrepancy Generator (DDG) that generates samples that enlarge domain discrepancy to mimic unpredictable corruptions; 2) a simple but effective teacher-student scheme with contrastive loss to enhance the constraints on target domains.
  arXiv  Detail & Related papers  (2021-04-21T06:27:48Z)
• Domain Agnostic Learning for Unbiased Authentication [47.85174796247398]
  We propose a domain-agnostic method that eliminates domain-difference without domain labels. latent domains are discovered by learning the heterogeneous predictive relationships between inputs and outputs. We extend our method to a meta-learning framework to pursue more thorough domain-difference elimination.
  arXiv  Detail & Related papers  (2020-10-11T14:05:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.