Working log behind Domain abuse: squatting, parking, expired domains and dangling DNS. Corpus-wide caveats (venue coverage, the selection funnel, provisional venue-years) are on corpus and are not restated here. Citations use the shared bibliography; the 41 entries this run added are listed under Bibliography below and belong to the content page, not to this log. No ~~DISCUSSION~~ block: comments belong on the content page.

Voice here is a working log. It is read by somebody checking a number.

• Create, not broaden. No existing page covers the namespace as the measured object. dns's own “Is this your page?” table sends “who owns a name (WHOIS, RDAP, the Public Suffix List)” elsewhere and excludes WHOIS/RDAP from its tool inventory on purpose, so registration data had no home. The page became the ninth child of security.
• Boundaries, as the item set them. Resolution measurement stays on dns; what a lookalike is used for (the phish) stays on phishing; Certificate Transparency as a data source stays on tls_certificates. The page uses CT only as one way to find names and links out for the log-list question.
• Four families — lookalike, parking, residual, dangling — defined by where the name's trust comes from, written into the inclusion rule before the verdicts were counted. “Residual” deliberately includes names that were never registered but are referenced or queried (NXDOMAIN traffic, name collisions, phantom links, app dependencies). One reading-notes agent disagreed on Hyperlink Hijacking (“the domains were never registered, so this is not residual trust”); the rule says otherwise and the verdict stands. Another argued To Err is Human is not a lookalike paper because unintended URLs are not brand imitations; the rule's lookalike family explicitly includes user-error names, so it stands too — but a reader could file it separately.
• Email typosquatting is IN; container-registry and package typosquatting are CONTEXT. The item asked for this decision. Email typosquatting registers DNS names and only the protocol carrying the mistaken traffic differs; it is also the main precedent for registering names to capture traffic, which the ethics section needs. Package and container registries are separate namespaces with their own naming and deletion rules. ENS drop-catching was the closest call and went CONTEXT for the same reason; the page says a reader could move it in.
• Section-level papers. A paper about something else is IN when one measured section reports an in-the-wild count of registrable, expired or dangling names (8 papers). Two papers that only ran a takeover or expiry check inside a broader audit with no reported count — passkey related origins, dedicated URL shorteners — are CONTEXT mention-check.
• Three selected-but-unretrieved papers are cited and not counted: All Your DNS Records Point to Us (CCS 2016), The Wolf of Name Street (CCS 2017) and Alias Equals Zone? (USENIX Security 2026). Their data/fulltext directories exist and are empty; the report script asserts that and fails if a directory stops being empty. The first two were read from author copies (eecis.udel.edu/~hnw/paper/ccs16a.pdf, acmccs.github.io/papers/p957-vissersA.pdf); no figure from either is used on the page.
• The ethics flag. ethics does not cover registering or claiming names to receive other people's traffic. The page flags this in a todo box and lays out the decisions the 19 papers expose; it does not write the ethics page's default. That is a separate item if Karel wants it.
• Currency judgements. “Current” on the page means used by a 2022–2026 paper in these venues; every should is marked as a judgement. Live WHOIS for registrant identity is dated superseded on external evidence (GDPR redaction, measured by Lu et al.; ICANN's 2025-01-28 WHOIS sunset and 2025-08-21 Registration Data Policy), not on the corpus, which still shows live WHOIS in 2026. Parking detection is dated historical as a subject because no parking-focused paper appears after 2015. LLM squatting detection is emerging outside these venues (0 of 48 here). The “one choice worth not copying” in What to read first is a judgement about letting research-registered domains expire back into the drop market; the page states the reasoning.

All probes read whitespace-collapsed paper.cols.txt except the gap-pass reproduction, which reads raw paper.norm.txt exactly as gap_probe_fulltext_20260922.mjs did. Regexes are in scripts/da_probes.mjs (embedded below).

• A bare dangling is a use-after-free pointer in this corpus. The first LIFE draft matched kernel-memory papers (FreeWill, FUZE, KernelRCA …); dangling is now only counted next to a DNS object.
• The first SCHEMA draft had 330 hits, mostly typo, impersonat, hijack (account takeover) and zone file as a data source. Narrowed to topic words; zone files as a source are counted separately in PASS E.
• Second-vocabulary sweep (domain shadowing, new gTLD, aftermarket, UDRP, sinkhole, ownership change, …; ≥ 5 hits): 21 papers outside the candidate set. One was on topic — Client-side Name Collision Vulnerability in the New gTLD Era (CCS 2017) — and name collisions? was added to LIFE. Domain Shadowing (USENIX 2021) is a CDN censorship-circumvention technique, not abuse; the rest are botnet sinkholing and unrelated.
• Title sweep over the venue index (16,864 records, TITLE_RE): 110 title hits, 32 not in the extraction. Three are on topic and selected-but-unretrieved (above); the other 29 are BGP, session, model and physical-system hijacking and dangling pointers. PASS C2 prints them.
• Slopsquatting. Spracklen et al., We Have a Package for You! (USENIX Security 2025) is in the venue index but was screened out (securityMeasurement and privacyMeasurement both false in labels.jsonl). A package-namespace paper in any case; mentioned in one sentence, not cited.

Every corpus figure on the page, and where the report prints it. PASS letters refer to report_domain_abuse.mjs (output below).

Guard: check_page_numbers.mjs pages/security_domain_abuse.txt <report + verification + external checks + notes quote check>, whole page. It leaves 4 tokens unaccounted, all fragments of identifiers its tokenizer splits (18.0 of UTS #39 version 18.0.0, 9.2 and 2.2 of policy section 9.2.2.2, 2025.3542036 of a DOI). They were deliberately not added to the shared ALLOW map.

• Verdicts (VERDICTS in da_fold.mjs): all 149 by the main agent, from title, extraction summary and probe hit counts, with full-text context read for the borderline ones, about two dozen (scripts/_da_ctx.mjs). Each row carries a one-line reason. The report exits if a candidate lacks a verdict or a verdict names a non-candidate.
• Codes (HAND): drafted from the reading notes' CODES lines and reviewed against the notes by the main agent, with these deliberate departures from the agents' codes: ethics other-body added for the counsel and industry-partner approvals the vocabulary did not have; ShamFinder's IRB checklist self-assessment coded discussed, not approved; Trufflehunter's own validation domain not counted as a registration or a claim; Hyperlink Hijacking coded approved on its sentence “complete with ethics approval”. Zombie Awakening registered “a domain” plus subdomains; its count is coded as not stated.
• Not double-coded. Treat single-paper differences as soft.
• Reading-note quote check (da_notes_quotecheck.mjs, output below): 956 of 1,129 quoted spans located (84.7%). The 173 misses concentrate in two files that did not machine-verify their quotes (batch A 78, batch D 60); the part files whose agents did verify score 92–98%. Misses are mostly column splices, the notes' own elisions with bracketed paraphrase, and spacing artefacts (PDN S for PDNS). The notes locate evidence; the page's figures are checked separately against the papers (next section).

scripts/verify_domain_abuse_figures.mjs looks up 133 needles — every per-paper figure and quoted sentence on the page — in paper.cols.txt, then paper.norm.txt, then paper.txt, then a pypdf re-extraction. Result: 119 located in paper.cols.txt, 14 only by pypdf, 0 not located; 4 needles shorter than 20 characters are printed WEAK. Three mutated control needles (100→10 times, $7.29→$7.92, 1,520→1,250) are not located.

Three needles failed on the first run and were real text, split by the two-column repair: Bitsquatting's “5,366 different bitsquatting domains targeting 491” (a column break inside the sentence — now two needles, abstract plus fragment), the IMC 2018 “no .com domain is re- / registered before 7 pm UTC”, and NDSS 2019's “taken-down” printed as “takendown”. None was a wrong figure.

Claims removed from the draft because a check failed or could not be made:

• “ShamFinder built SimChar because the Unicode confusables list misses glyphs that render alike” — the paper says SimChar “can be maintained without requiring time-consuming manual effort” and is used alongside Unicode's list; the stated motive was not in the paper. Rewritten to what it says.
• “Liu et al.'s dangling-record study leans on open ccTLD zones” — coded by a reading agent; no zone-file sentence in the pypdf text of the author copy. Removed.
• “dnstwist's defaults changed across releases” — not checked against its changelog. Removed.
• “The Deno team was handed the name” — the authors did not register it; “Deno team decided to register the problematic domain in response to our disclosure”. Rewritten.
• “much registry-operator research appears at DNS-OARC and eCrime” — plausible, not measured. Removed.
• Alrwais et al.'s “0.8% to 40.3%” was a range written from two single-service figures (“at least 0.8%” for one reputable service, 40.3% for another). Rewritten as two figures.

Non-corpus facts are re-fetched by scripts/external_checks_domain_abuse.sh where a stable phrase or API field exists (output below; exit gate is its FAILS counter); the rows below say where that is not the case. First run FAILS=5, all checker defects and none a changed fact: NIS2 needs the CELLAR Accept headers (HTTP 400 without); ICANN prints “DNS Abuse” in curly quotes and the needle used single quotes; the CZDS page's wording is not the sentence the external agent quoted from czds.icann.org; Chromium's idn.md wraps “skeleton” in a Markdown link; doi.org returns 403 to curl, so the DarkDNS DOI is checked through the Crossref API. Second run FAILS=0. After the generic review (G9) five more checks were added — URLCrazy's “17 types” and licence footer, dnstwist's import tlsh, the old JuxhinDB/twistrs path answering 301, the parked-domain template names, and ICANN's “in place of sunsetted WHOIS services” — and the run is still FAILS=0.

Rejected, and why:

• External agent E2's finding “.com and .net are NOT available via CZDS.” The agent inferred it from ICANN's generic CZDS text; it was not a fetched fact, and it is wrong: Verisign's own page says “To request access to the zone files for the .com, .net, and .name TLDs … use ICANN's Centralized Zone Data Service (CZDS)”. It would have put a false instruction in the sources table.
• External agent E1's framing of the seven corpus venues as “excluded venues.” It led the agent to prefer an arXiv replication over the USENIX Security 2025 slopsquatting paper. Checked instead against the index and the screening labels (above).
• An unqualified “Spaulding et al. typosquatting survey.” No single such paper; the nearest is an ARES 2016 landscape paper. Not cited.
• Vendor posts on “phantom squatting” / AI-hallucinated domains (Unit 42, Cloud Security Alliance, Socket.dev) and trade-press coverage. Vendor research without a peer-reviewed or preprint companion; their widely repeated figures are not used.
• Firefox's network.IDN.restriction_profile preference. The external agent found it no longer exists in mozilla-central (gecko-dev mirror and searchfox). The page does not teach browser IDN policy and cites none of it.
• SEO listicles and blogs the external agents met (whoisfreaks, domaindetails, notrenewing, catchdoms, aeserver, sitepoint, namepros, circleid, cybersectools, a jpmens post, GitHub mirrors of ICANN documents, icewolf.ch) — used as leads at most, never as evidence.

• What fraction of post-2025 ownership inferences still work under the Registration Data Policy. No paper measures it; the page lists it as open.
• ccTLD squatting. Almost every lookalike count in the population is a gTLD count.
• Whether typosquatting of DNS names declined after 2021 or only stopped being published in these venues. The corpus cannot separate the two.
• Why 18 of 27 papers since 2020 have an ethics section and no review body — declined by a board, or never asked. Not recorded in the papers.
• Parking Sensors' classifier accuracy. The extracted text loses the number with a dropped table; the page cites the classifier, not its accuracy.
• The RDRS pilot's exact start day (28 November 2023) comes from ICANN search metadata the external agent did not open; the page says “November 2023”.
• The 29 non-topical title hits were judged by title only.

• The first report script ran out of memory (V8 heap limit) by caching every collapsed paper.cols.txt. Rewritten as one pass that keeps counts only.
• /strider/ matched Microsoft's Strider HoneyMonkeys citations (54 papers, heavy in 2010–2012). Narrowed to /typo-?patrol/ (24).
• temporal is an array in the schema, so a temporal.mode enum line printed “undefined 48”. Removed; time is hand-coded.
• Two bibliography entries already existed under other keys (kaleli2021_human, wen2025_automatic). My existence check had grepped only the keys I had chosen; bib_dedup_scan.py caught both as DEFINITE by title. The page was repointed before anything was saved.
• Four bibgen author strings were scrape artefacts (Joosenand, Nikiforakisy on Vissers et al. 2015) or had the particle in the wrong place (De Carli, Van Acker, Van Goethem). Fixed by hand.
• Method-table year ranges were first written from memory and five were wrong (typo models 2013→2014, combosquatting 2017→2017–2019, live WHOIS to 2025→2026, re-registration from 2014→2017, fingerprint scanning 2024→2025). Re-derived from the hand codes.
• The first external-checks run failed five times, all checker defects (above).
• Prose written over the numbers — the generic review's findings G1–G5, G11–G15: a denominator swapped in prose while the needle check passed (Akiwate et al.'s 88% belongs to 48,185 unresolvable nameserver domains, not to all lame delegations); two superlatives no query computes (“the most active line”, “the modal outcome”); a currency sentence that contradicted the page's own open question; and “nineteen papers received other people's traffic” where seven did. Every one passed the figure and citation passes, which check digits and sources, not the sentence around them.

Four passes, in the order the task prescribes: three focused Claude Sonnet passes in parallel on the snapshot frozen in out/da/rev1/ (page md5 1d322d7d…, provenance 8b53da5e…), then one Claude Fable generic pass on the corrected snapshot out/da/rev2/. Every reviewer was told the author's context may not be exhaustive and was given the page, this log, the report script and its output, the needle checker and its output, and the reading notes. Findings files: notes/da_review_{figures,citations,external,generic}.md.

Re-ran report_domain_abuse.mjs: byte-identical to the committed output.

All 51 citekeys resolve one-to-one; no colliding keys among the 40 new entries; 21 new entries checked against first pages or Crossref; all “Name et al.” attributions match.

Everything re-fetched independently and current, except:

Snapshot out/da/rev2/ (page md5 65ef9794…), after the focused fixes. 21 findings, 0 blockers. Every corpus count the reviewer re-derived matched the report; ten ethics-table rows were checked against the papers' wording and matched.

Re-run after these fixes: report exit 0; needle check 140 needles, 0 not located; external checks FAILS=0; check_page_numbers.mjs leaves the same 4 identifier fragments.

Every reviewer's findings were acted on, so the changed text was reviewed once more rather than re-running all four passes: one Sonnet pass over the rev1 → rev3 diff (out/da/rev3/page_rev1_to_rev3.diff), the dispositions above, and the re-run script outputs. It confirmed every changed number, quote and citation, and found two things the fixes introduced:

Which reviewer earned its slot. The citations pass found the one bibliography defect (a slug as a title) and a real mis-attribution; the figures pass found a count that contradicted its neighbour; the external pass found a DOI that resolves to a differently titled paper. The generic pass found the largest number of page-level problems, all of the same kind: true figures inside sentences that claimed more than the figures do.

node scripts/report_domain_abuse.mjs against the 5,859-paper extraction.

report_domain_abuse-output.txt

=== PASS A — candidate probes (full text, paper-counted) ===
papers: 5859; with paper.norm.txt: 5859; with paper.cols.txt: 5855
probe                                                                                rendering                             threshold  papers
-----------------------------------------------------------------------------------  ------------------------------------  ---------  ------
GAP (2026-09-22 gap pass, as run)                                                    paper.norm.txt, raw                   >= 5       85
GAP (same regex)                                                                     paper.cols.txt, whitespace-collapsed  >= 5       90
SQUAT (every squatting model and synonym)                                            cols, collapsed                       >= 5       68
LIFE (expiry, drop, residual trust, dangling DNS objects, takeover, name collision)  cols, collapsed                       >= 5       51
PARK (parking and monetisation)                                                      cols, collapsed                       >= 5       21
REG (zone files, CZDS, NRD, WHOIS, RDAP, registrar)                                  cols, collapsed                       >= 30      45
SCHEMA (detection / classification / population free text)                           extraction                            any        67
UNION = candidate set                                                                                                                 149
gap pass as run: 85 papers >= 5; 47 include the web platform; 40 crawled; 25 from 2024–2026
 
=== PASS B — hand verdicts over the candidate set ===
INCLUSION RULE (written 2026-09-25, before the verdicts were counted):
IN      — the paper's measured objects include DNS names (registered domains, subdomains, or the
          records and delegations behind them) whose abuse comes from the NAME or its LIFECYCLE,
          and the paper counts instances in the wild (generates or collects candidates and
          resolves, crawls, registers, classifies or detects them). Four families:
            lookalike — typo/combo/bit/sound/homograph squatting of a live name, user-error names
                        (unintended URLs, email typos), defensive registration and disputes about it;
            parking   — parked domains, parking monetisation, and what registrations are used for;
            residual  — names that keep receiving trust or traffic they were not meant to: expired,
                        dropped and re-registered names, taken-down names released again,
                        referenced-but-unregistered names (NXDOMAIN traffic, name collisions,
                        phantom links, expired dependencies of apps and code);
            dangling  — records and delegations that point at something the owner no longer
                        controls: dangling CNAME/A records and subdomain takeover, lame and
                        orphaned delegations, stale NS and glue, released cloud IPs, DNS-hosting
                        zones created by someone else.
          scope P = the paper's subject; S = one measured section of a paper about something else
          (the section must report an in-the-wild count, not only mention the risk).
CONTEXT — adjacent, cited as a pointer, not counted: squatting or lifecycle abuse in a namespace
          that is not DNS (packages, container images, apps, voice skills, social handles,
          blockchain names, wallet addresses); a lookalike name only as the vehicle of phishing,
          scams or fraud, which is the object (security:phishing, security:online_scams); the
          registration system itself as instrument or object (WHOIS/RDAP, zone files, registrars);
          malicious-domain detection, DGA, takedown and sinkholing; hijacking through resolver or
          registrar attacks (design:dns); search poisoning on misspellings; user studies of
          lookalike URLs; a takeover/expiry check inside a broader audit with no in-the-wild count.
OUT     — homonyms ("dangling" pointers, "homography", "re-register" an account), or the terms
          occur only in related work, as a data source, or in passing.
Decisions recorded with the rule: email typosquatting is IN (the object is a registered DNS name;
only the protocol delivering the mistaken traffic differs). Container-registry and package
typosquatting are CONTEXT (a different registry with its own namespace rules). ENS/blockchain
names are CONTEXT for the same reason, although ENS dropcatching reuses the dropcatching design.
 
candidates 149: IN 48 (32.2%), CONTEXT 41 (27.5%), OUT 60 (40.3%)
IN by scope: primary 40, section 8
 
CONTEXT, by code (papers):
code               papers  meaning
-----------------  ------  ------------------------------------------------------------------------------------------------------------------------------
other-namespace    14      squatting or lifecycle abuse in a non-DNS namespace (packages, containers, apps, skills, handles, blockchain names, addresses)
malicious-domains  8       malicious-domain detection, DGA, registration-time detection, takedown, sinkholing
uses               5       a lookalike or re-registered name is only the vehicle; the phishing / scam / fraud it carries is the object
registration-data  4       WHOIS/RDAP, zone files, registrar or registry operation as the instrument or object
dns-attack         4       hijacking via resolver, cache or registrar-account attacks; resolver behaviour (design:dns)
mention-check      3       a takeover / expiry check inside a broader audit, no in-the-wild count
search-abuse       2       search poisoning on misspellings, wildcard-DNS spam
user-study         1       people judging lookalike URLs
 
OUT, by code (papers):
code     papers  meaning
-------  ------  -----------------------------------------------------------------------------------------
mention  52      terms only in related work, a data source, a cleaning step, or in passing
homonym  8       "dangling" pointer, "homography", account "re-registration", "registrar" in another sense
 
Precision and recall of each probe against the IN set:
probe            hits  IN  precision  CONTEXT  recall of IN
---------------  ----  --  ---------  -------  -----------------
GAP >= 5 (cols)  90    38  42.2%      27       38 of 48 (79.2%)
SQUAT >= 5       68    22  32.4%      22       22 of 48 (45.8%)
LIFE >= 5        51    29  56.9%      14       29 of 48 (60.4%)
PARK >= 5        21    10  47.6%      3        10 of 48 (20.8%)
REG >= 30        45    20  44.4%      10       20 of 48 (41.7%)
SCHEMA           67    36  53.7%      17       36 of 48 (75.0%)
UNION            149   48  32.2%      41       48 of 48 (100.0%)
IN papers the GAP probe misses:
  IMC/2010/an-empirical-study-of-orphan-dns-servers-in-the-internet  (dangling/P; gap hits 2)
  IEEE-SP/2016/mitm-attack-by-name-collision-cause-analysis-and-vulnerability-assessment-in-the  (residual/P; gap hits 0)
  CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study  (residual/P; gap hits 1)
  IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers  (lookalike/S; gap hits 0)
  IMC/2021/risky-bizness-risks-derived-from-registrar-name-management  (dangling/P; gap hits 2)
  CCS/2023/iotflow-inferring-iot-device-behavior-at-scale-through-static-mobile-companion-a  (residual/S; gap hits 1)
  IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d  (dangling/P; gap hits 4)
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure  (dangling/P; gap hits 1)
  IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem  (dangling/S; gap hits 0)
  NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild  (residual/S; gap hits 0)
GAP >= 5 (cols) and IN: 38; GAP set from 2024–2026: 27, of which IN 11 (primary 7)
GAP set, 2024–2026, by verdict/code:
  OUT:mention	8
  CONTEXT:other-namespace	4
  IN:residual/S	3
  IN:residual/P	3
  IN:dangling/P	2
  IN:lookalike/P	2
  CONTEXT:mention-check	2
  IN:dangling/S	1
  CONTEXT:user-study	1
  CONTEXT:uses	1
 
=== PASS C — the IN population ===
IN: 48 papers (primary 40, section 8); include the web platform: 24; crawled (corpus definition): 18
 
By year bucket and family (P = primary, S = section; 2025–2026* provisional):
bucket      IN  lookalike P/S  parking P/S  residual P/S  dangling P/S  CONTEXT
----------  --  -------------  -----------  ------------  ------------  -------
2010–2013   2   1/0            0/0          0/0           1/0           2
2014–2017   13  5/0            3/0          5/0           0/0           7
2018–2021   13  5/1            0/0          3/0           4/0           13
2022–2024   11  0/0            0/0          4/2           4/1           11
2025–2026*  9   2/0            0/0          2/3           1/1           8
 
By family (all years):
family     papers  primary  section  years                                                                                           meaning
---------  ------  -------  -------  ----------------------------------------------------------------------------------------------  ----------------------------------------------------------------------------------------------------------------
lookalike  14      13       1        2013,2014,2015,2015,2017,2017,2018,2019,2019,2020,2021,2021,2025,2026                           typo/combo/bit/homograph squatting, user-error names, defensive registration, disputes
parking    3       3        0        2014,2015,2015                                                                                  parked domains, parking monetisation, what registrations are used for
residual   19      14       5        2016,2016,2016,2017,2017,2018,2018,2019,2022,2023,2023,2023,2024,2024,2025,2025,2025,2025,2026  expired / dropped / re-registered / released / referenced-but-unregistered names
dangling   12      10       2        2010,2020,2020,2021,2021,2022,2023,2024,2024,2024,2025,2025                                     dangling records, subdomain takeover, lame/orphaned delegation, stale NS/glue, released cloud IPs, hosting zones
 
By year (IN):
2010: 1; 2013: 1; 2014: 2; 2015: 4; 2016: 3; 2017: 4; 2018: 3; 2019: 3; 2020: 3; 2021: 4; 2022: 2; 2023: 4; 2024: 5; 2025*: 7; 2026*: 2
 
By venue (IN):
CCS 5; IMC 15; NDSS 10; PETS 1; USENIX 9; WWW 3; IEEE-SP 5
 
CONTEXT other-namespace by year (where squatting research went):
14 papers: 2018, 2019, 2019, 2020, 2021, 2022, 2022, 2023, 2023, 2024, 2024, 2024, 2025*, 2025*; lookalike IN primary by year: 2013, 2014, 2015, 2015, 2017, 2017, 2018, 2019, 2019, 2021, 2021, 2025*, 2026*
 
IN papers (year — key — family/scope — note):
  2010  IMC/2010/an-empirical-study-of-orphan-dns-servers-in-the-internet  — dangling/P — orphan NS/glue records left in TLD zones after the parent domain is deleted; abuse by malicious domains
  2013  WWW/2013/bitsquatting-exploiting-bit-flips-for-fun-or-profit  — lookalike/P — bitsquatting registrations of Alexa top-500 targets, crawled 270 days
  2014  USENIX/2014/the-long-taile-of-typosquatting-domain-names  — lookalike/P — typosquatting across the .com zone and popularity levels
  2014  USENIX/2014/understanding-the-dark-side-of-domain-parking  — parking/P — parking monetisation chains traced with controlled parking and traffic-buying accounts
  2015  IEEE-SP/2015/every-second-counts-quantifying-the-negative-externalities-of-cybercrime-via-typ  — lookalike/P — typosquatting traffic and user time lost, passive DNS/HTTP and proxy logs
  2015  IMC/2015/from-academy-to-zone-an-analysis-of-the-new-tld-land-rush  — parking/P — new-gTLD registrations classified by use: parked, unused, defensive redirect, content
  2015  NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains  — parking/P — parked-domain classifier and prevalence across 15 parking services
  2015  NDSS/2015/seven-months-worth-of-mistakes-a-longitudinal-study-of-typosquatting-abuse  — lookalike/P — daily crawl of generated typo domains of Alexa top 500 for seven months
  2016  IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in  — residual/P — residual trust of expired domains; Alembic detector
  2016  IEEE-SP/2016/mitm-attack-by-name-collision-cause-analysis-and-vulnerability-assessment-in-the  — residual/P — leaked WPAD queries for new-gTLD names that anyone can register (name collision)
  2016  IMC/2016/whois-lost-in-translation-mis-understanding-domain-name-expiration-and-re-regist  — residual/P — expiration, deletion and re-registration timing from zone removals plus WHOIS
  2017  CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study  — residual/P — service-discovery queries leaking into registrable new-gTLD names
  2017  CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse  — lookalike/P — combosquatting from passive/active DNS, 2.7M domains, 268 trademarks
  2017  IMC/2017/email-typosquatting  — lookalike/P — registered typo domains of email providers and counted the mail they received
  2017  USENIX/2017/game-of-registrars-an-empirical-analysis-of-post-expiration-domain-name-takeover  — residual/P — post-expiration re-registration across five TLDs; dropcatch registrars
  2018  IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri  — residual/P — .com drop timing, dropcatch registrar clusters
  2018  IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild  — lookalike/P — five squatting models over 224M DNS records; classified which squatting domains phish
  2018  WWW/2018/panning-for-gold-com-understanding-the-dynamics-of-domain-dropcatching  — residual/P — 28.4M expiring domains; dropcatch services; post-re-registration use
  2019  CCS/2019/you-are-who-you-appear-to-be-a-longitudinal-study-of-domain-impersonation-in-tls  — lookalike/P — impersonating names in TLS certificates (Censys), incl. typo and homograph
  2019  IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs  — lookalike/P — IDN homograph detection in .com; homoglyph database
  2019  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs  — residual/P — taken-down domains released or re-bought after sinkhole domains expired
  2020  CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr  — dangling/P — stale NS records at DNS hosting providers that let anyone claim the zone
  2020  IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers  — lookalike/S — case study: estimates users of typosquatting domains by cache snooping public resolvers
  2020  IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations  — dangling/P — nine years of lame delegations; registrable nameserver domains
  2021  IMC/2021/risky-bizness-risks-derived-from-registrar-name-management  — dangling/P — sacrificial nameserver renaming by registrars; hijackable delegations
  2021  NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media  — lookalike/P — unintended URLs in tweets; registered 45 such domains and counted the traffic
  2021  USENIX/2021/assessing-browser-level-defense-against-idn-based-phishing  — lookalike/P — IDN homographs in .com and browser IDN display policies
  2021  USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web  — dangling/P — subdomain takeover conditions across Tranco sites and what a takeover grants
  2022  IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust  — residual/P — re-registered 201 expired domains and logged residual traffic
  2022  IEEE-SP/2022/measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds  — dangling/P — released cloud IPs still named by DNS records and configs
  2023  CCS/2023/iotflow-inferring-iot-device-behavior-at-scale-through-static-mobile-companion-a  — residual/S — section: abandoned (re-registrable) domains still used by IoT companion apps
  2023  IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to  — residual/P — NXDOMAIN query volume in passive DNS; registered 19 NXDomains with honeypots
  2023  IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls  — residual/P — certificates still valid after the domain changed hands
  2023  IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d  — dangling/P — undelegated records on DNS hosting services, abused in the wild
  2024  IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s  — residual/S — section: bounced mail to unregistered or expired recipient domains that a squatter could register
  2024  NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services  — dangling/S — section: protective-DNS rewrites pointing at dangling cloud addresses
  2024  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure  — dangling/P — shared authoritative infrastructure lets another customer claim a zone
  2024  USENIX/2024/rethinking-the-security-threats-of-stale-dns-glue-records  — dangling/P — stale glue in 1,096 TLD zones; takeover exposure
  2024  WWW/2024/hyperlink-hijacking-exploiting-erroneous-url-links-to-phantom-domains  — residual/P — links in Common Crawl to unregistered "phantom" domains; registered 51 and measured traffic
  2025*  IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem  — dangling/S — section: 6k time servers with dangling upstream IP addresses
  2025*  NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild  — residual/S — section: auto-configuration lookups to registrable domains (24,149 affected domains)
  2025*  NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange  — residual/S — section: resold domains and dangling domains sharing certificates with Tranco sites
  2025*  NDSS/2025/the-guardians-of-name-street-studying-the-defensive-registration-practices-of-the-fortune-500  — lookalike/P — defensive registrations of Fortune 500 companies
  2025*  NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem  — residual/S — section: Deno packages importing code from expired domains
  2025*  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps  — residual/P — expired domains in Android apps' DNS footprints, longitudinally
  2025*  USENIX/2025/misty-registry-an-empirical-study-of-flawed-domain-registry-operation  — dangling/P — registries leaving delegations of deleted ("relic") domains, stale glue, IDN twin takeover
  2026*  NDSS/2026/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles  — lookalike/P — 90,153 UDRP cybersquatting disputes; transfers checked in zone files
  2026*  PETS/2026/dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android  — residual/P — lifecycle (expiry, re-registration, dangling CNAME) of 3,420 domains used by Android apps
 
=== PASS C2 — selected papers with no full text (title sweep over the venue index) ===
venue index: 16864 records; title-probe hits: 110; not in the extraction: 32
  CCS/2016/all-your-dns-records-point-to-us-understanding-the-security-threats-of-dangling — dangling — the founding dangling-DNS measurement — fulltext dir exists and is EMPTY
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers — dangling — nameserver-domain expiry and typos as a hijack vector — fulltext dir exists and is EMPTY
  USENIX/2026/alias-equals-zone-large-scale-and-stealthy-takeover-of-domain-hosting-service-vi — dangling — CNAME-following verification at DNS hosting services — fulltext dir exists and is EMPTY
Other title hits not in the extraction (read by title; none is on topic — hijacking of BGP, sessions, models, physical systems, dangling pointers):
  CCS 2022  Physical Hijacking Attacks against Object Trackers.
  CCS 2025  ImportSnare:  Directed 'Code Manual' Hijacking in Retrieval-Augmented Code Generation.
  CCS 2025  ControlLoc: Physical-World Hijacking Attack on Camera-based Perception in Autonomous Driving.
  IEEE-SP 2012  Distance Hijacking Attacks on Distance Bounding Protocols.
  IEEE-SP 2020  LVI: Hijacking Transient Execution through Microarchitectural Load Value Injection.
  IEEE-SP 2026  Hijacking Large Audio-Language Models via Context-Agnostic and Imperceptible Auditory Prompt Injecti
  IEEE-SP 2026  One Char to Rule Them All: Systematically Exploring and Exploiting DNS Silent Vulnerabilities in Dom
  IMC 2012  Detecting prefix hijackings in the internet with argus.
  NDSS 2012  Distance Hijacking Attacks on Distance Bounding Protocols
  NDSS 2014  AppSealer: Automatic Generation of Vulnerability-Specific Patches for Preventing Component Hijacking
  NDSS 2015  Preventing Use-after-free with Dangling Pointers Nullification
  NDSS 2015  FreeSentry: Protecting Against Use-After-Free Vulnerabilities Due to Dangling Pointers
  NDSS 2020  When Match Fields Do Not Need to Match: Buffered Packets Hijacking in SDN
  NDSS 2021  ROV++: Improved Deployable Defense against BGP Hijacking
  NDSS 2022  Get a Model! Model Hijacking Attack Against Machine Learning Models
  NDSS 2023  Focusing on Pinocchio’s Nose: A Gradients Scrutinizer to Thwart Split-Learning Hijacking Attacks Usi
  PETS 2014  Measuring the Leakage of Onion at the Root, A measurement of Tor's .onion pseudo-top-level domain in
  USENIX 2010  Cling: A Memory Allocator to Mitigate Dangling Pointers
  USENIX 2012  Gone in 360 Seconds: Hijacking with Hitag2
  USENIX 2016  Crashing Drones and Hijacked Cameras: CyberTrust Meets CyberPhysical
  USENIX 2017  Oscar: A Practical Page-Permissions-Based Scheme for Thwarting Dangling Pointers
  USENIX 2019  KEPLER: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities
  USENIX 2023  Two-in-One: A Model Hijacking Attack Against Text Generation Models
  USENIX 2023  Jinn: Hijacking Safe Programs with Trojans
  USENIX 2024  Hijacking Attacks against Neural Network by Analyzing Training Data
  USENIX 2024  π-Jack: Physical-World Adversarial Attack on Monocular Depth Estimation with Perspective Hijacking
  USENIX 2026  A Cuckoo in the Nest: Multi‑Stage, Multi‑Identifier Hijacking in BACnet/SC
  USENIX 2026  HijackKV: New Threat in Position-Independent KV Cache Reuse
  USENIX 2026  Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments
 
=== PASS D — hand-coded method attributes of the IN papers (from reading notes; see da_fold.mjs) ===
denominator: the 48 IN papers; eras: 2010–2014 4, 2015–2019 17, 2020–2024 18, 2025–2026* 9
 
gen:
gen          papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
-----------  ------  -----  ---------  ---------  ---------  ----------  -------------------------------------------------------------------------------------------------------
typo-models  8       16.7%  1          6          0          1           keyboard / edit-distance typo models (omission, insertion, substitution, transposition, missing dot, …)
combo        4       8.3%   0          3          0          1           trademark plus added tokens (combosquatting)
bit          3       6.3%   1          1          0          1           single bit flips
homoglyph    5       10.4%  0          3          1          1           homoglyph / IDN confusables
sound        1       2.1%   0          0          0          1           homophones (soundsquatting)
named-tool   4       8.3%   1          2          1          0           a named generator (dnstwist, URLCrazy, ShamFinder/SimChar, the authors' own released tool)
user-error   1       2.1%   0          0          1          0           names produced by user error that is not a typo of a target (unintended URLs)
observed     37      77.1%  2          11         16         8           no generator: names come from records, traffic, lists or apps
 
src:
src             papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
--------------  ------  -----  ---------  ---------  ---------  ----------  -------------------------------------------------------------------------------
zone            20      41.7%  2          8          7          3           TLD zone files (CZDS, registry agreement, open ccTLD AXFR, or a zone archive)
ct              6       12.5%  0          2          2          2           Certificate Transparency / certificate scans
pdns            11      22.9%  1          3          4          3           passive DNS
active-dns      11      22.9%  0          3          5          3           active DNS datasets or the authors' own large-scale resolution
resolution      2       4.2%   1          1          0          0           the authors resolved their own generated candidates
drop-lists      5       10.4%  0          4          1          0           pending-delete / drop lists, registry deletion data
whois           31      64.6%  2          15         9          5           WHOIS, live or historical
rdap            1       2.1%   0          1          0          0           RDAP
registry        3       6.3%   0          3          0          0           registry- or ICANN-provided data, registry partner
web-crawl       8       16.7%  1          5          2          0           a web crawl or web corpus (own, Common Crawl, archives)
app-traffic     4       8.3%   0          0          1          3           app code or app traffic
toplist         18      37.5%  2          7          6          3           a top list or company list as the target set
threat-intel    6       12.5%  2          3          0          1           blocklists and threat feeds as a source of names
traffic-logs    4       8.3%   0          3          1          0           traffic, query or delivery logs (ISP, enterprise, root servers, email provider)
cache-snooping  1       2.1%   0          0          1          0           public-resolver cache snooping
other           10      20.8%  0          0          6          4           another source (dispute records, IP allocations, resolver or provider lists)
 
whois:
whois       papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
----------  ------  -----  ---------  ---------  ---------  ----------  ------------------------
none        17      35.4%  2          2          9          4           not used
live        25      52.1%  2          13         6          4           live WHOIS
historical  10      20.8%  0          3          3          4           historical WHOIS product
rdap        1       2.1%   0          1          0          0           RDAP
 
label:
label       papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
----------  ------  -----  ---------  ---------  ---------  ----------  --------------------------------------
manual      32      66.7%  4          12         10         6           researchers looked
heuristic   36      75.0%  4          13         11         8           rules
classifier  7       14.6%  1          4          1          1           trained classifier
blocklist   13      27.1%  2          7          3          1           blocklist / VirusTotal / Safe Browsing
vendor      6       12.5%  1          2          3          0           commercial categoriser or vendor feed
none        3       6.3%   0          0          3          0           no labelling
 
ethics:
ethics        papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
------------  ------  -----  ---------  ---------  ---------  ----------  ------------------------------------------------------------------------------
approved      4       8.3%   0          2          2          0           an IRB or ethics board approved (any part of) the study
exempt        3       6.3%   0          1          2          0           an IRB ruled it exempt / not human-subjects research
other-body    3       6.3%   0          0          3          0           approved by a non-IRB body (general counsel, the partner's network department)
discussed     21      43.8%  1          2          10         8           ethics section, no review body
not-required  1       2.1%   0          0          1          0           authors state no review was needed
none          16      33.3%  3          12         0          1           nothing
 
notify:
notify  papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
------  ------  -----  ---------  ---------  ---------  ----------  ------------------------------------------------------
yes     24      50.0%  0          4          14         6           notified someone (owners, providers, registries, CERT)
no      12      25.0%  1          7          2          2           no notification stated
na      12      25.0%  3          6          2          1           nothing to notify
 
time:
time          papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
------------  ------  -----  ---------  ---------  ---------  ----------  ----------------------
longitudinal  35      72.9%  4          12         12         7           repeated observation
snapshot      13      27.1%  0          5          6          2           one observation window
 
artifacts:
artifacts  papers  of 48  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
---------  ------  -----  ---------  ---------  ---------  ----------  -------------------
public     14      29.2%  0          4          6          4           code or data public
promised   2       4.2%   0          1          0          1           promised
request    2       4.2%   0          0          1          1           on request
none       30      62.5%  4          12         11         3           none mentioned
 
gen among the 14 lookalike papers:
gen          papers  of 14  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
-----------  ------  -----  ---------  ---------  ---------  ----------  -------------------------------------------------------------------------------------------------------
typo-models  7       50.0%  1          5          0          1           keyboard / edit-distance typo models (omission, insertion, substitution, transposition, missing dot, …)
combo        4       28.6%  0          3          0          1           trademark plus added tokens (combosquatting)
bit          3       21.4%  1          1          0          1           single bit flips
homoglyph    5       35.7%  0          3          1          1           homoglyph / IDN confusables
sound        1       7.1%   0          0          0          1           homophones (soundsquatting)
named-tool   3       21.4%  1          2          0          0           a named generator (dnstwist, URLCrazy, ShamFinder/SimChar, the authors' own released tool)
user-error   1       7.1%   0          0          1          0           names produced by user error that is not a typo of a target (unintended URLs)
observed     3       21.4%  0          1          1          1           no generator: names come from records, traffic, lists or apps
 
use among the 30 papers that classify what the names do (use is not only na / unused / traffic-only):
use              papers  of 30  2010–2014  2015–2019  2020–2024  2025–2026*  meaning
---------------  ------  -----  ---------  ---------  ---------  ----------  ---------------------------------------------
parked           15      50.0%  3          8          3          1           parked / ads
defensive        8       26.7%  1          4          1          2           defensive registration by the owner
redirect-target  3       10.0%  1          2          0          0           redirects to the target
redirect-other   13      43.3%  3          6          2          2           redirects elsewhere
affiliate        5       16.7%  2          3          0          0           affiliate abuse
malicious        24      80.0%  4          11         6          3           malicious (blocklist, VirusTotal, manual)
phishing         4       13.3%  1          2          0          1           phishing
for-sale         5       16.7%  0          4          0          1           for sale
unused           13      43.3%  0          4          5          4           unused / unregistered / no DNS
content          8       26.7%  1          5          1          1           own content
error            7       23.3%  0          6          1          0           error pages
traffic-only     1       3.3%   1          0          0          0           only the traffic it receives is measured
na               0       0.0%   0          0          0          0           the paper does not classify what the names do
of those 30, separate defensive registrations: 8 (2014,2015,2015,2015,2019,2020,2025,2025); the rest cannot tell a brand's own registration from a squat unless they say so
 
registered domains themselves: 15 of 48 papers (exact count not stated for 2); total over the 13 with an exact count: 535 domains; claimed third-party names, zones, NS slots or cloud IPs: 6; either: 19
per paper that registered or claimed (year — key — reg — claimed — ethics — notify):
  2014  understanding-the-dark-side-of-domain-parking                 reg=23  claimed=no  ethics=discussed  notify=no
  2015  parking-sensors-analyzing-and-detecting-parked-domains        reg=1  claimed=no  ethics=none  notify=no
  2017  client-side-name-collision-vulnerability-in-the-new-gtld-era  reg=1  claimed=no  ethics=none  notify=no
  2017  email-typosquatting                                           reg=76  claimed=no  ethics=approved  notify=na
  2019  cracking-the-wall-of-confinement-understanding-and-analyzing  reg=0  claimed=yes  ethics=none  notify=yes
  2020  zombie-awakening-stealthy-hijacking-of-active-domains-throug  reg=n/s  claimed=no  ethics=discussed  notify=yes
  2021  risky-bizness-risks-derived-from-registrar-name-management    reg=5  claimed=yes  ethics=other-body  notify=yes
  2021  to-err-is-human-characterizing-the-threat-of-unintended-urls  reg=45  claimed=no  ethics=exempt  notify=no
  2022  domains-do-change-their-spots-quantifying-potential-abuse-of  reg=201  claimed=no  ethics=discussed  notify=na
  2022  measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clou  reg=0  claimed=yes  ethics=exempt  notify=yes
  2023  dial-n-for-nxdomain-the-scale-origin-and-security-implicatio  reg=19  claimed=no  ethics=discussed  notify=yes
  2023  wolf-in-sheeps-clothing-evaluating-security-risks-of-the-und  reg=0  claimed=yes  ethics=discussed  notify=yes
  2024  bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-  reg=30  claimed=no  ethics=other-body  notify=yes
  2024  cross-the-zone-toward-a-covert-domain-hijacking-via-shared-d  reg=0  claimed=yes  ethics=discussed  notify=yes
  2024  rethinking-the-security-threats-of-stale-dns-glue-records     reg=n/s  claimed=yes  ethics=discussed  notify=yes
  2024  hyperlink-hijacking-exploiting-erroneous-url-links-to-phanto  reg=51  claimed=no  ethics=approved  notify=no
  2025*  automatic-insecurity-exploring-email-auto-configuration-in-t  reg=2  claimed=no  ethics=discussed  notify=yes
  2025*  cross-origin-web-attacks-via-http-2-server-push-and-signed-h  reg=1  claimed=no  ethics=discussed  notify=yes
  2025*  misty-registry-an-empirical-study-of-flawed-domain-registry-  reg=80  claimed=no  ethics=discussed  notify=yes
of those, logged the traffic, mail or queries that arrived for someone else (hand list LOGGED_ARRIVALS): 7 — years 2017,2021,2021,2022,2022,2023,2024
review outcome among those 19: approved 2, exempt 2, other-body 2, discussed 10, not-required 0, none 3
papers whose use label includes "traffic-only" (the measurement is what the name receives): 5 (2014,2020,2022,2022,2024)
lookalike papers with a top list or company list as the target set: 9 of 14
ethics = none: 12 of the 17 papers from 2015–2019; 1 of the 27 from 2020–2026*; ethics section without a review body (discussed) among 2020–2026*: 18
section-level papers by year: 2020, 2023, 2024, 2024, 2025, 2025, 2025, 2025; from 2023–2025: 7 of 8
 
WHOIS/RDAP used: 31 of 48; historical product: 10; RDAP: 1; used WHOIS by era: 2010–2014 2/4, 2015–2019 15/17, 2020–2024 9/18, 2025–2026* 5/9
 
per paper:
  2010 dang/P an-empirical-study-of-orphan-dns-servers-in- gen=observed | src=zone+threat-intel | whois=none | use=malicious+content | label=heuristic+manual+blocklist | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
  2013 look/P bitsquatting-exploiting-bit-flips-for-fun-or gen=bit | src=toplist+resolution+web-crawl | whois=none | use=parked+affiliate+malicious+redirect-other | label=manual+heuristic+vendor | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
  2014 look/P the-long-taile-of-typosquatting-domain-names gen=typo-models+named-tool | src=zone+toplist+threat-intel+whois | whois=live | use=parked+redirect-target+redirect-other+affiliate+malicious+phishing+defensive | label=heuristic+classifier+manual+blocklist | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
  2014 park/P understanding-the-dark-side-of-domain-parkin gen=observed | src=pdns+whois | whois=live | use=parked+redirect-other+malicious+traffic-only | label=heuristic+manual | reg=23 | claimed=n | ethics=discussed | notify=no | longitudinal | art=none
  2015 look/P every-second-counts-quantifying-the-negative gen=typo-models+observed | src=traffic-logs+web-crawl+whois | whois=live | use=defensive+redirect-target+malicious+parked+unused | label=heuristic+manual+blocklist | reg=0 | claimed=n | ethics=exempt | notify=na | longitudinal | art=none
  2015 park/P from-academy-to-zone-an-analysis-of-the-new- gen=observed | src=zone+registry+whois+active-dns+web-crawl+toplist | whois=live | use=parked+unused+defensive+redirect-other+content+for-sale+error | label=classifier+manual+heuristic | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
  2015 park/P parking-sensors-analyzing-and-detecting-park gen=observed+typo-models | src=zone+whois+toplist+web-crawl | whois=live | use=parked+redirect-other+malicious | label=heuristic+manual+classifier | reg=1 | claimed=n | ethics=none | notify=no | snapshot | art=none
  2015 look/P seven-months-worth-of-mistakes-a-longitudina gen=typo-models | src=toplist+resolution+web-crawl+whois | whois=live | use=parked+defensive+redirect-target+redirect-other+affiliate+malicious+content+for-sale+error | label=heuristic+manual | reg=0 | claimed=n | ethics=none | notify=no | longitudinal | art=public
  2016 resi/P domain-z-28-registrations-later-measuring-th gen=observed | src=zone+drop-lists+threat-intel+whois | whois=historical | use=malicious+redirect-other+unused | label=heuristic | reg=0 | claimed=n | ethics=none | notify=yes | longitudinal | art=none
  2016 resi/P mitm-attack-by-name-collision-cause-analysis gen=observed | src=traffic-logs+zone+whois+registry | whois=historical | use=unused+na | label=heuristic | reg=0 | claimed=n | ethics=discussed | notify=no | longitudinal | art=none
  2016 resi/P whois-lost-in-translation-mis-understanding- gen=observed | src=zone+whois | whois=live | use=na | label=heuristic | reg=0 | claimed=n | ethics=none | notify=no | longitudinal | art=none
  2017 resi/P client-side-name-collision-vulnerability-in- gen=observed | src=traffic-logs | whois=none | use=na | label=manual+heuristic | reg=1 | claimed=n | ethics=none | notify=no | snapshot | art=none
  2017 look/P hiding-in-plain-sight-a-longitudinal-study-o gen=combo | src=pdns+active-dns+ct+threat-intel+toplist+whois | whois=live | use=phishing+affiliate+malicious+parked+error+content | label=manual+heuristic+vendor+blocklist | reg=0 | claimed=n | ethics=none | notify=no | longitudinal | art=none
  2017 look/P email-typosquatting                          gen=typo-models | src=zone+whois | whois=live | use=na | label=heuristic+manual | reg=76 | claimed=n | ethics=approved | notify=na | longitudinal | art=promised
  2017 resi/P game-of-registrars-an-empirical-analysis-of- gen=observed | src=drop-lists+whois+registry | whois=live | use=parked+for-sale+malicious+error | label=manual | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
  2018 resi/P from-deletion-to-re-registration-in-zero-sec gen=observed | src=drop-lists+rdap+whois | whois=rdap+live | use=malicious | label=blocklist | reg=0 | claimed=n | ethics=none | notify=no | snapshot | art=none
  2018 look/P needle-in-a-haystack-tracking-down-elite-phi gen=homoglyph+typo-models+bit+combo+named-tool | src=active-dns+toplist+whois | whois=live | use=phishing | label=classifier+manual | reg=0 | claimed=n | ethics=none | notify=yes | snapshot | art=public
  2018 resi/P panning-for-gold-com-understanding-the-dynam gen=observed | src=zone+drop-lists+whois+web-crawl | whois=live | use=parked+error+malicious+affiliate+content+unused | label=classifier+heuristic+manual+blocklist+vendor | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=none
  2019 look/P you-are-who-you-appear-to-be-a-longitudinal- gen=typo-models+combo+homoglyph | src=ct+whois+toplist | whois=live | use=malicious | label=blocklist | reg=0 | claimed=n | ethics=approved | notify=na | longitudinal | art=public
  2019 look/P shamfinder-an-automated-framework-for-detect gen=homoglyph+named-tool | src=zone+toplist+pdns | whois=none | use=parked+redirect-other+for-sale+error+malicious+content+defensive | label=heuristic+manual+blocklist | reg=0 | claimed=n | ethics=discussed | notify=yes | snapshot | art=public
  2019 resi/P cracking-the-wall-of-confinement-understandi gen=observed | src=pdns+whois+threat-intel | whois=live+historical | use=malicious+redirect-other | label=heuristic+manual+blocklist | reg=0 | claimed=y | ethics=none | notify=yes | longitudinal | art=none
  2020 dang/P zombie-awakening-stealthy-hijacking-of-activ gen=observed | src=toplist+pdns+other+whois | whois=live | use=na | label=vendor | reg=n/s | claimed=n | ethics=discussed | notify=yes | longitudinal | art=none
  2020 look/S trufflehunter-cache-snooping-rare-domains-at gen=observed | src=cache-snooping | whois=none | use=traffic-only | label=none | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=public
  2020 dang/P unresolved-issues-prevalence-persistence-and gen=observed | src=zone+active-dns+whois | whois=live | use=unused+error+malicious+parked+defensive | label=heuristic+manual | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=none
  2021 dang/P risky-bizness-risks-derived-from-registrar-n gen=observed | src=zone+whois | whois=historical | use=parked+redirect-other+unused | label=heuristic+manual | reg=5 | claimed=y | ethics=other-body | notify=yes | longitudinal | art=none
  2021 look/P to-err-is-human-characterizing-the-threat-of gen=user-error | src=other+web-crawl | whois=none | use=content+parked+malicious+unused | label=manual+blocklist+classifier | reg=45 | claimed=n | ethics=exempt | notify=no | longitudinal | art=public
  2021 look/P assessing-browser-level-defense-against-idn- gen=homoglyph | src=zone+toplist | whois=none | use=na | label=none | reg=0 | claimed=n | ethics=approved | notify=yes | snapshot | art=public
  2021 dang/P can-i-take-your-subdomain-exploring-same-sit gen=observed | src=toplist+ct+other+whois | whois=live | use=unused+redirect-other+malicious | label=heuristic+manual | reg=0 | claimed=n | ethics=discussed | notify=yes | snapshot | art=none
  2022 resi/P domains-do-change-their-spots-quantifying-po gen=observed | src=pdns+drop-lists | whois=none | use=traffic-only | label=heuristic+manual | reg=201 | claimed=n | ethics=discussed | notify=na | longitudinal | art=none
  2022 dang/P measuring-and-mitigating-the-risk-of-ip-reus gen=observed | src=other+toplist | whois=none | use=traffic-only | label=manual+heuristic | reg=0 | claimed=y | ethics=exempt | notify=yes | longitudinal | art=none
  2023 resi/S iotflow-inferring-iot-device-behavior-at-sca gen=observed | src=app-traffic+whois | whois=live | use=unused | label=manual | reg=0 | claimed=n | ethics=discussed | notify=yes | snapshot | art=public
  2023 resi/P dial-n-for-nxdomain-the-scale-origin-and-sec gen=observed | src=pdns+whois | whois=historical | use=malicious+unused | label=vendor+blocklist | reg=19 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=request
  2023 resi/P stale-tls-certificates-investigating-precari gen=observed | src=ct+whois+zone | whois=historical | use=malicious | label=vendor+heuristic+manual | reg=0 | claimed=n | ethics=not-required | notify=na | longitudinal | art=none
  2023 dang/P wolf-in-sheeps-clothing-evaluating-security- gen=observed | src=toplist+pdns+other | whois=none | use=malicious | label=blocklist+heuristic | reg=0 | claimed=y | ethics=discussed | notify=yes | snapshot | art=public
  2024 resi/S bounce-in-the-wild-a-deep-dive-into-email-de gen=observed+named-tool | src=traffic-logs+active-dns+whois | whois=live | use=unused | label=heuristic | reg=30 | claimed=n | ethics=other-body | notify=yes | longitudinal | art=none
  2024 dang/S understanding-the-implementation-and-securit gen=observed | src=active-dns+other | whois=none | use=unused | label=heuristic | reg=0 | claimed=n | ethics=other-body | notify=yes | snapshot | art=public
  2024 dang/P cross-the-zone-toward-a-covert-domain-hijack gen=observed | src=zone+toplist+whois | whois=live | use=unused | label=heuristic+manual | reg=0 | claimed=y | ethics=discussed | notify=yes | snapshot | art=none
  2024 dang/P rethinking-the-security-threats-of-stale-dns gen=observed | src=zone+active-dns | whois=none | use=na | label=none | reg=n/s | claimed=y | ethics=discussed | notify=yes | longitudinal | art=none
  2024 resi/P hyperlink-hijacking-exploiting-erroneous-url gen=observed | src=web-crawl+zone+active-dns | whois=none | use=traffic-only | label=heuristic+manual | reg=51 | claimed=n | ethics=approved | notify=no | longitudinal | art=none
  2025* dang/S measuring-the-time-source-vulnerabilities-in gen=observed | src=active-dns+other | whois=none | use=unused | label=heuristic | reg=0 | claimed=n | ethics=discussed | notify=no | snapshot | art=request
  2025* resi/S automatic-insecurity-exploring-email-auto-co gen=observed | src=toplist+other | whois=none | use=unused | label=heuristic | reg=2 | claimed=n | ethics=discussed | notify=yes | snapshot | art=none
  2025* resi/S cross-origin-web-attacks-via-http-2-server-p gen=observed | src=whois+active-dns+ct+pdns+toplist | whois=live+historical | use=unused | label=heuristic | reg=1 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=none
  2025* look/P the-guardians-of-name-street-studying-the-de gen=typo-models+bit+homoglyph+sound+combo | src=zone+pdns+whois+toplist | whois=live+historical | use=defensive | label=heuristic+manual | reg=0 | claimed=n | ethics=discussed | notify=no | longitudinal | art=public
  2025* resi/S welcome-to-jurassic-park-a-comprehensive-stu gen=observed | src=app-traffic | whois=none | use=unused+for-sale | label=manual+heuristic | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=none
  2025* resi/P lost-in-the-mists-of-time-expirations-in-dns gen=observed | src=app-traffic+pdns+whois | whois=historical | use=unused+malicious+parked+content | label=manual+heuristic | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=public
  2025* dang/P misty-registry-an-empirical-study-of-flawed- gen=observed | src=zone+whois+other | whois=live+historical | use=defensive+unused+redirect-other+phishing | label=manual+heuristic | reg=80 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=promised
  2026* look/P repairing-trust-in-domain-name-disputes-prac gen=observed | src=other+zone+threat-intel | whois=none | use=malicious | label=blocklist+classifier+manual | reg=0 | claimed=n | ethics=none | notify=na | longitudinal | art=public
  2026* resi/P dead-domains-living-data-a-privacy-risk-anal gen=observed | src=app-traffic+whois+active-dns+ct | whois=live | use=unused+redirect-other+malicious | label=heuristic+manual | reg=0 | claimed=n | ethics=discussed | notify=yes | longitudinal | art=public
 
=== PASS E — data sources named in the extraction (population[].sourceList, plus tools[] names that hit a source family) ===
denominator: the 48 IN papers
family           papers  of 48  meaning
---------------  ------  -----  ------------------------------------------------------------------------------------------------------------------
zone-czds        9       18.8%  ICANN Centralized Zone Data Service
zone-file        15      31.3%  a TLD zone file or zone transfer, however obtained
zone-aggregate   6       12.5%  a third party's archive of zone files (DZDB, DNS Coffee, DNS Census, domainlists.io, Domains Project, DomainScope)
ct               3       6.3%   Certificate Transparency logs
scan-dataset     4       8.3%   Internet-wide scan datasets (Censys, Rapid7)
pdns             9       18.8%  passive DNS (Farsight/DNSDB/SIE or other)
active-dns       4       8.3%   active DNS measurement datasets (Active DNS Project, OpenINTEL)
drop             6       12.5%  drop / pending-delete lists and drop-catch services
whois            19      39.6%  WHOIS (live or historical, any client)
rdap             1       2.1%   RDAP
registry         4       8.3%   registry- or ICANN-provided data (monthly reports, registration logs, a registry partner)
toplist          27      56.3%  a top list (Alexa, Tranco, Umbrella, Majestic, Fortune 500)
web-corpus       6       12.5%  a web corpus or archive (Common Crawl, Internet Archive)
threat-intel     26      54.2%  blocklists, VirusTotal, Safe Browsing, threat feeds
traffic          6       12.5%  traffic or query logs (ISP, enterprise proxy, email delivery, root/TLD query data, Netflow)
apps             5       10.4%  app stores and APK corpora
resolvers-hosts  4       8.3%   resolver, nameserver or hosting-provider lists and IPv4-wide scans
dispute          1       2.1%   domain-dispute providers (UDRP)
any zone data (czds ∪ zone-file ∪ zone-aggregate): 20 of 48
unmapped population[].sourceList strings among IN papers (14 distinct; NOT_A_SOURCE excluded on purpose):
  1  crawler-discovered bitsquatting domains
  1  random sample of old-TLD domains
  1  random sample of DZ
  1  active domains in DZ
  1  Verisign
  1  three prior datasets: Neupane et al., IoTSpotter, and IoTProfiler
  1  Mozilla mandatory disclosure list
  1  Top100Provider
  1  GovDomain
  1  BankDomain
  1  FreeDisposableProvider
  1  PSChecker visits
  1  Browser User-Agent observations
  1  top 16 domains in the dependency dataset
 
corpus-wide (all 5859 papers), same fold: CZDS 21; any zone file 52; zone aggregate 7; CT 57; passive DNS 74; active DNS datasets 25; WHOIS 119; RDAP 3; drop lists 44
CZDS papers by year: 2015 1, 2016 1, 2017 1, 2021 1, 2022 1, 2023 5, 2024 5, 2025* 5, 2026* 1
CZDS papers from 2023 on: 16 of 21
 
=== PASS F — WHOIS and RDAP in full text, by year (currency of the registration-data instrument) ===
year   papers  WHOIS >=1  WHOIS >=3  RDAP >=1  RDAP >=3  RDAP, no WHOIS  RDAP share of (WHOIS>=3 or RDAP>=3)
-----  ------  ---------  ---------  --------  --------  --------------  -----------------------------------
2010   118     7          4          0         0         0               0.0%
2011   116     11         1          0         0         0               0.0%
2012   151     7          3          0         0         0               0.0%
2013   125     11         2          0         0         0               0.0%
2014   165     11         5          0         0         0               0.0%
2015   190     18         9          0         0         0               0.0%
2016   182     25         14         0         0         0               0.0%
2017   231     23         11         1         0         0               0.0%
2018   254     18         8          1         1         0               11.1%
2019   402     28         10         2         1         0               9.1%
2020   402     27         8          0         0         0               0.0%
2021   379     20         9          2         1         1               10.0%
2022   546     37         13         1         0         0               0.0%
2023   719     27         10         0         0         0               0.0%
2024   690     36         17         2         1         1               5.6%
2025*  770     38         20         1         1         0               4.8%
2026*  415     14         7          0         0         0               0.0%
IN papers mentioning WHOIS: 35 of 48; RDAP: 3 (2018 from-deletion-to-re-registration-in-zero; 2024 hyperlink-hijacking-exploiting-erroneous; 2025 misty-registry-an-empirical-study-of-fla); GDPR or "redact": 8 (years 2021,2023,2023,2024,2025,2025,2026,2026)
 
=== PASS G — candidate-generator names in full text (corpus-wide, paper-counted, >= 1 mention) ===
generator / checker            papers (any mention)  IN  CONTEXT  years
-----------------------------  --------------------  --  -------  -------------------------------------------------------------------------------------------------------------------------
dnstwist                       5                     3   2        2018,2020,2022,2024,2025*
URLCrazy                       3                     1   1        2018,2020,2024
Strider Typo-Patrol            24                    14  5        2013,2014,2014,2015,2015,2015,2017,2017,2017,2019,2019,2020,2020,2020,2021,2021,2021,2022,2022,2022,2023,2024,2025*,2025*
Unicode confusables / UTS #39  5                     2   0        2019,2021,2022,2022,2025*
ShamFinder / SimChar           6                     3   0        2019,2021,2021,2022,2024,2025*
ail-typo-squatting             0                     0   0
opensquat                      0                     0   0
can-i-take-over-xyz            2                     2   0        2021,2024
subjack                        0                     0   0
dnsReaper                      0                     0   0
nuclei                         2                     0   0        2025*,2025*
 
=== PASS H — parked pages in other people's crawls (crawled population, full-text mention, not verified per paper) ===
crawled papers: 1120; mention parking at least once: 50; of those not IN here: 38
  2010 IMC detecting-algorithmically-generated-malicious-domain-names [CONTEXT]
  2010 CCS dissecting-one-click-frauds [not a candidate]
  2011 IMC understanding-fraudulent-activities-in-online-ad-exchanges [not a candidate]
  2011 IEEE-SP click-trajectories-end-to-end-analysis-of-the-spam-value-chain [OUT]
  2012 IEEE-SP evilseed-a-guided-approach-to-finding-malicious-web-pages [not a candidate]
  2013 IEEE-SP finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicat [OUT]
  2014 CCS a-nearly-four-year-longitudinal-study-of-search-engine-poisoning [not a candidate]
  2014 USENIX automatically-detecting-vulnerable-websites-before-they-turn-malicious [not a candidate]
  2016 WWW characterizing-long-tail-seo-spam-on-cloud-web-hosting-services [not a candidate]
  2016 WWW no-honor-among-thieves-a-large-scale-analysis-of-malicious-web-shells [OUT]
  2016 IEEE-SP sending-out-an-sms-characterizing-the-security-of-the-sms-ecosystem-wi [not a candidate]
  2016 IEEE-SP cloak-of-visibility-detecting-when-machines-browse-a-different-web [not a candidate]
  2017 NDSS dial-one-for-scam-a-large-scale-analysis-of-technical-support-scams [CONTEXT]
  2017 NDSS thou-shalt-not-depend-on-me-analysing-the-use-of-outdated-javascript-l [not a candidate]
  2017 PETS topics-of-controversy-an-empirical-analysis-of-web-censorship-lists [OUT]
  2018 WWW exposing-search-and-advertisement-abuse-tactics-and-infrastructure-of- [not a candidate]
  2018 IEEE-SP surveylance-automatically-detecting-online-survey-scams [not a candidate]
  2019 IEEE-SP measuring-and-analyzing-search-engine-poisoning-of-linguistic-collisio [CONTEXT]
  2019 IMC measuring-ewhoring [not a candidate]
  2019 IMC what-you-see-is-not-what-you-get-discovering-and-tracking-social-engin [not a candidate]
  2019 USENIX inadvertently-making-cyber-criminals-rich-a-comprehensive-study-of-cry [not a candidate]
  2019 WWW outguard-detecting-in-browser-covert-cryptocurrency-mining-in-the-wild [not a candidate]
  2021 CCS cyberbunker-2-0-a-domain-and-traffic-perspective-on-a-bulletproof-host [not a candidate]
  2021 NDSS from-whois-to-whowas-a-large-scale-measurement-study-of-domain-registr [CONTEXT]
  2021 PETS the-cname-of-the-game-large-scale-analysis-of-dns-based-tracking-evasi [not a candidate]
  2021 WWW privacy-policies-over-time-curation-and-analysis-of-a-million-document [OUT]
  2021 WWW websocket-adoption-and-the-landscape-of-the-real-time-web [not a candidate]
  2021 WWW where-are-you-taking-me-understanding-abusive-traffic-distribution-sys [CONTEXT]
  2022 IMC characterizing-permanently-dead-links-on-wikipedia [not a candidate]
  2022 WWW investigating-advertisers-domain-changing-behaviors-and-their-impacts- [not a candidate]
  2023 IMC ecn-with-quic-challenges-in-the-wild [not a candidate]
  2023 IMC reviving-dead-links-on-the-web-with-fable [not a candidate]
  2023 PETS comparing-large-scale-privacy-and-security-notifications [OUT]
  2024 PETS automatic-generation-of-web-censorship-probe-lists [not a candidate]
  2025 NDSS hades-attack-understanding-and-evaluating-manipulation-risks-of-email- [OUT]
  2025 WWW before-after-the-effect-of-eus-2022-code-of-practice-on-disinformation [not a candidate]
  2026 NDSS loki-proactively-discovering-online-scams-by-mining-toxic-search-queri [not a candidate]
  2026 NDSS phishlang-a-real-time-fully-client-side-phishing-detection-framework-u [OUT]
 
=== PASS I — LLMs (classification[].method == "llm") ===
IN papers with an llm classification tuple: 0 of 48
CONTEXT papers with one: 2 of 41 — 2026 ctphishcapture-uncovering-credential-theft-based-p (uses); 2026 indicator-of-benignity-an-industry-view-of-false-p (malicious-domains)
corpus-wide: 177 of 5859; by year: 2023 2 of 719, 2024 27 of 690, 2025* 77 of 770, 2026* 71 of 415
IN papers from 2025–2026*: 9 (primary 5); with an llm tuple: 0
 
=== PASS J — extraction enums over the IN papers (nulls and sentinels shown, never counted as answers) ===
ethics.reviewOutcome: none-mentioned 27; NULL (no ethics object) 6; explicitly-discussed-no-review 6; approved 4; not-required 2; sought-outcome-unstated 2; exempt 1  (of 48)
ethics.notifiedAffectedParties: yes 16; not-stated 10; partial 10; NULL (no ethics object) 6; not-applicable 4; no 2  (of 48)
artifacts.availability: none-mentioned 25; public 14; NULL (no artifacts object) 3; on-request 2; promised-not-yet-available 2; explicitly-withheld 1; restricted 1  (of 48)
 
=== PASS K — detection[] tuples of the IN papers (prevalence is a model summary: every figure the page uses is re-checked against paper.cols.txt by verify_domain_abuse_figures.mjs) ===
 
# IMC/2010/an-empirical-study-of-orphan-dns-servers-in-the-internet (8 tuples)
  - orphan DNS servers | metric: share of examined A records | prevalence: 1.7% of A records in the six accessible TLDs were orphans | quote: "39,443 (85%) of orphans are in the TLDs we have zone files for, representing 1.7% of the A records in our TLDs"
  - orphan DNS server prevalence | metric: daily average orphan count | prevalence: 15,962 orphans recorded per day; 46,369 total | quote: "Overall, we find a total of 46,369 orphans. Each day, we record an average of 15,962 orphans."
  - orphan lifetimes | metric: median lifetime | prevalence: Median lifetime was between 8 and 9 days | quote: "The median lifetime for an orphan is between 8 and 9 days"
  - DNS use of orphans | metric: share of orphans used by domains | prevalence: Almost one-third of orphans were used as nameservers | quote: "almost 1/3rd of the orphans are actually in use as a name server by at least one domain."
  - HTTP and SMTP services | metric: share of unique orphan IP addresses with open ports | prevalence: 33% had port 80 open and 22% had port 25 open | quote: "We find that 33% of the unique IP addresses of orphans have port 80 open ... Additionally, 22% have port 25 open"
  - webpage content | metric: content categories among checked orphans | prevalence: 1.4% of checked orphans hosted Canadian Pharmacy scams | quote: "Such scams were on 1.4% of the orphans we checked."
  - malicious DNS users | metric: share of orphan-using domains | prevalence: 1.1% appeared in phishing feeds and 1.3% in malware feeds | quote: "2,250 (1.1%) ... are in our phishing feeds. Similarly, 2,838 (1.3%) ... are in our malware feeds."
  - spam-associated orphan IPs | metric: share of orphan IP addresses blacklisted | prevalence: 4% appeared in SBL and 0.4% in XBL | quote: "4% of IP addresses of orphans appear in the SBL and 0.4% in the XBL."
 
# WWW/2013/bitsquatting-exploiting-bit-flips-for-fun-or-profit (5 tuples)
  - bitsquatting domain registrations | metric: unique discovered domains and growth from baseline | prevalence: 5,366 unique domains; 46% increase over the experiment | quote: "In a nine-month period, we recorded a total of 5,366 unique bitsquatting domains, showing a 46% increase from the first day of our experiment."
  - bitsquatting targeting | metric: number of targeted authoritative domains | prevalence: 491 of the Alexa top 500 domains targeted | quote: "we discovered a total of 5,366 different bitsquatting domains targeting 491 out of the Alexa top 500 domains."
  - typosquatting overlap | metric: share of bitsquatting domains not typosquatting | prevalence: 3,854 domains, or 71.8%, were not typosquatting domains | quote: "The results of this analysis are presented in Table 2 and show that 3,854 or 71.8% of the bitsquatting domains are not typosquatting domains."
  - parked-domain monetization | metric: share of registered bitsquatting domains showing ads | prevalence: more than 50% | quote: "more than 50% of all registered bitsquatting domains are used to show ads, through the use of dedicated domain-parking agencies."
  - malware delivery | metric: share of antivirus engines flagging malware | prevalence: 2.3% flagged one executable as packed malware; 28.6% flagged a fake antivirus | quote: "Five other domains, e.g., microskft.com and microsogt.com, were redirecting the unsuspecting user to the domain errorfix.com. That site was offering an "Advanced Registry Repair tool", which was flagged as a fake antivir"
 
# USENIX/2014/the-long-taile-of-typosquatting-domain-names (8 tuples)
  - candidate typo domains | metric: count of registered candidate typos | prevalence: approximately 4.7 million domains | quote: "The subset of the gtypo list which was registered within the .com TLD includes approximately 4.7 million domains."
  - true typosquatting domains | metric: share of all .com registrations | prevalence: about 20% of the total domain set; approximately 21.2 million domains | quote: "We estimate that about 53% of them are candidate typo domains and hence 20% of the total domain set are true typo domains."
  - typosquatting across popularity levels | metric: share of candidate typos that are true typos | prevalence: around 50% within the set of all candidate typo domains | quote: "The number of true typo domains steadily decreases when we perform the same experiment for the Alexa mid and tail domains, yet it remains high (around 50% within the set of all ctypo domains)."
  - typosquatting target popularity | metric: share targeting Alexa top 10,000 .com domains | prevalence: only 6.8% target the 10,000 most popular .com domains | quote: "Only 6.8% target the 10,000 most popular .com domains."
  - monetization strategy | metric: distribution of true typo categories | prevalence: the bulk of true typo registrations profits from parked domains with advertisements | quote: "We observe that the bulk of the true typo registrations profits from parked domains with advertisements."
  - malicious domain presence | metric: blacklist hit percentage | prevalence: Alexa domains were more likely to appear on blacklists than candidate or true typos | quote: "The Alexa domains are more likely to appear on black lists than the typos of them, either ctypos or ttypos."
  - domain registration trends | metric: stable share, mean uptime, and reregregistration share | prevalence: measured from 2012-10-01 to 2014-02-20 | quote: "We define a registration event as one where a domain was not in a daily zone dump, and was present in the subsequent day's zone file."
  - YATT categorization accuracy | metric: precision, false positives, false negatives, and true positives | prevalence: parking-domain identification achieved about 85% precision | quote: "It matches these domains with about 85% precision, the error stemming from the incompleteness of the set of regular expressions we use."
 
# USENIX/2014/understanding-the-dark-side-of-domain-parking (5 tuples)
  - click fraud | metric: share of labeled monetization chains | prevalence: 97K (45.7%) labeled PPC monetization chains | quote: "All labeled 97K (45.7%) PPC monetization chains are clearly fraudulent clicks, as our crawlers never clicked on any ads."
  - traffic spam | metric: share of PPR monetization chains | prevalence: 70.7% of all PPR monetization chains | quote: "As a result, we found that 70.7% of all PPR monetization chains are traffic spam"
  - traffic stealing | metric: unreported versus billed hits | prevalence: 23 traffic hits billed by 7Search but unreported by the parking service | quote: "we, as a campaign owner, were billed for 23 traffic hits by 7Search ... but nothing was reported by the parking service"
  - malware distribution | metric: share of PPR traffic buyers | prevalence: at least 3.7% of PPR traffic buyers | quote: "we concluded that at least 3.7% of the PPR traffic buyers spread malware."
  - illicit monetization | metric: fraction of total revenue | prevalence: up to 40.3% for PS5 | quote: "For others, this revenue source is even more significant (e.g., 40.3% for PS5 whom we found to be aggressive in its illicit monetizations)."
 
# IEEE-SP/2015/every-second-counts-quantifying-the-negative-externalities-of-cybercrime-via-typ (5 tuples)
  - typosquatting domains | metric: classification accuracy | prevalence: 61,274 unique candidate domain pairs; 86.5% accuracy at the selected threshold | quote: "After this filtering step, we arrived at 61,274 unique pairs of domains."
  - typosquatting domains | metric: classification accuracy | prevalence: 95% accuracy at high conditional-probability thresholds | quote: "at high conditional probability thresholds, the accuracy of the passive detection method is 95%"
  - user time loss | metric: seconds of delay per event | prevalence: 1.3 seconds per typosquatting event over an unregistered typo | quote: "typosquatting costs the typical user 1.3 seconds per typosquatting event over the alternative of receiving a browser error page"
  - visitor loss | metric: visitor-loss rate | prevalence: Legitimate sites lose approximately 5% of mistyped traffic | quote: "legitimate sites lose approximately 5% of their mistyped traffic over the alternative of an unregistered typo."
  - malicious typo domains | metric: number of listed domains | prevalence: 33 VirusTotal-listed and 9 Google Safe Browsing-listed among 11.1K adversarial domains | quote: "Among all 11.1K adversarial domains seen in the dataset, 33 were listed on VirusTotal ... and 9 on Google Safe Browsing"
 
# IMC/2015/from-academy-to-zone-an-analysis-of-the-new-tld-land-rush (8 tuples)
  - Web content categories | metric: share of domains by category | prevalence: Parked 31.9%; Content 10.2%; No DNS 15.6% | quote: "Table 3: Overall content classifications for all domains in the zone file for the new public TLDs."
  - Registration intent | metric: share of domains with inferred intent | prevalence: Primary 14.6%, Defensive 39.7%, Speculative 45.6% | quote: "Primary 372,569 14.6% Defensive 1,010,954 39.7% Speculative 1,161,892 45.6%"
  - Non-resolving domains | metric: share of domains | prevalence: 16% of domains with NS records do not resolve; 5.5% lack zone-file NS information | quote: "Out of 3,638,209 domains in the new TLDs, we had 567,390 DNS failures with an associated NS record, or 15.6%."
  - Domain parking | metric: share of domains | prevalence: 1,161,892 domains, or 31.9% of all domains in zone files | quote: "We discovered 1,161,892 parked domains in our data set, or 31.9% of all domains in the zone files."
  - Defensive redirects | metric: share of domains | prevalence: 236,380 off-domain redirects, or 6.5% | quote: "We find 236,380 off-domain redirects in our data set, or 6.5% of all domains in the new TLD zone files."
  - User visitation | metric: appearances per 100,000 registrations | prevalence: 88.1 new-TLD versus 243 old-TLD Alexa-top-million appearances | quote: "New domain registrations in the old TLDs are nearly three times more likely to appear in the Alexa top million when compared to registrations in the new TLDs."
  - Blacklist appearance | metric: appearances per 100,000 registrations | prevalence: 703 new-TLD versus 331 old-TLD URIBL appearances | quote: "We find that domains in new TLDs are twice as likely to appear on the URIBL blacklist within the first month."
  - Registry profitability | metric: fraction of TLDs profitable | prevalence: About half recouped the $185,000 application fee; about 10% profitable at $500,000 cost | quote: "At this cost, roughly half of all TLDs made this money back. ... At this estimate, only about 10% of TLDs are profitable."
 
# NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains (8 tuples)
  - parked-domain prevalence | metric: number of parked domains | prevalence: over 8 million parked domains | quote: "By collecting data from over 8 million parked domains, we are able to map out the entities that constitute the ecosystem."
  - typosquatting | metric: share of parked domains | prevalence: 131,673 domains (1.63%) | quote: "We applied the reverse-typo transformations to the 8 million parked domains and found a total of 131,673 typosquatting domains (1.63%)."
  - advertisement syndicator presence | metric: share of parked websites | prevalence: four syndicators had aggregate presence of 91%±1% | quote: "Their aggregate presence reaches 91%±1% of the parked websites."
  - trademark abuse | metric: share of sampled domains | prevalence: 79 of 500 domains (16%±3.2%) | quote: "Out of the 500 investigated parked domains, 79 (16%±3.2%) domains were clearly abusing trademarks of existing companies and websites."
  - malicious redirections | metric: share of visits to parked domains | prevalence: 7%±0.9% experienced Pay-Per-Redirect | quote: "Out of our initial 3,000 randomly sampled pages, our instrumented browser was redirected to a different domain in 7%±0.9% of the cases."
  - malicious redirections | metric: parking services with malware or scams | prevalence: all ten redirecting services redirected to malware or scams | quote: "When one considers both regions, all ten services were found to redirect to malware or scams at some point during those seven days."
  - ad-blocker detection and bypass | metric: number of parking services | prevalence: 2 of 15 services | quote: "Overall, we discovered that 2 out of the 15 studied services attempted to detect and bypass advertising blockers."
  - parked-page classification | metric: true-positive and false-positive rates | prevalence: 97.9% true-positive rate and 0.5% false-positive rate | quote: "This classifier can be straightforwardly incorporated in a browser through its extension system, and alert users whenever they land on a parked domain."
 
# NDSS/2015/seven-months-worth-of-mistakes-a-longitudinal-study-of-typosquatting-abuse (7 tuples)
  - typosquatting prevalence | metric: share of authoritative domains with malicious typosquatting | prevalence: 477 of 500 domains, or 95%, had at least one malicious typosquatting domain. | quote: "Out of these 500 domains, 477 have at least one malicious typosquatting domain."
  - defensive registrations | metric: share of authoritative domains without defensive registrations | prevalence: 344 domains, representing 68.8% of the 500 most popular sites, had no defensive registrations. | quote: "only 156 of the authoritative domains in our list have defensive domain registrations, meaning that 344 domains (representing 68.8% of the 500 most popular sites of the Internet) have no defensive registrations whatsoeve"
  - page-category changes | metric: average category transitions per domain | prevalence: 2.84 transitions per domain over seven months | quote: "If we average the total number of category transitions over the number of discovered typosquatting domains, we get a value of 2.84 transitions per domain over the seven month data gathering period."
  - shared typosquatting hosting | metric: fraction hosted by four subnets | prevalence: Four subnets hosted 36% of malicious pages and 50% of malicious domains visited. | quote: "the four subnets shown in Table III together host 36% of all malicious typosquatting pages and 50% of all malicious typosquatting domains visited during the study."
  - IP-address volatility | metric: CDF of distinct /24 subnets per domain | prevalence: Malicious domains were more likely than legitimate domains to resolve to multiple subnets. | quote: "malicious domains are much more likely to resolve to more than one subnet over time than legitimate domains."
  - TLD typosquatting saturation | metric: typosquatting saturation per TLD | prevalence: TLDs without out-of-court arbitration had the highest saturation; Brazilian and Japanese TLDs were significantly lower. | quote: "We can see that the two TLDs without an out-of-court arbitration option have the highest typosquatting saturation."
  - typosquatting model saturation | metric: active fraction of possible variants | prevalence: The missing-dot model was most popular; character substitution was below 40%. | quote: "out of all possible typosquatting domains generated by this model, less than 40% are in use."
 
# IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in (4 tuples)
  - Residual trust abuse after domain expiration | metric: number and share of expired domains associated with abuse | prevalence: 385,741 expired domains appeared on public blacklists or were resolved by malware | quote: "In total, DZ comprises 385,741 domains."
  - Malicious re-registration of expired domains | metric: domains abused after expiration | prevalence: 27,758 blacklist domains and 238,279 malware-resolved domains expired before abuse | quote: "Conversely, we observed 263,847 domains that expired before appearing in DM ∪ DB . More specifically, 238,279 (90.3%) domains were contacted by malware and 27,758 (10.5%) appeared on public blacklists only after expiring"
  - Growth of residual trust abuse | metric: annual or multi-year counts | prevalence: Blacklist instances increased from 784 between 2009–2012 to over 9,000 in 2014 | quote: "The number of domains being contacted by malware after expiration grew from 6,138 between 2009 and 2012 to over 12,000 in just 2013. Similarly, the number ... has grown from 784 ... to over 9,000 in 2014 alone."
  - Potential ownership changes | metric: ownership scores and confirmed changes within observation windows | prevalence: 4,543 (25.5%) of 17,838 known changes fell within an Alembic observation window | quote: "In total, we find 4,543 (25.5%) of all changes fall within an Alembic observation window."
 
# IEEE-SP/2016/mitm-attack-by-name-collision-cause-analysis-and-vulnerability-assessment-in-the (4 tuples)
  - WPAD query leakage | metric: average daily leaked queries and distinct IP/domain pairs | prevalence: more than 20 million leaked queries every day and at least 6.6 million potential victim users | quote: "WPAD protocol is ranked top 4 with more than 20 million leaked queries every day... these queries are estimated to have at least 6.6 million potential victim users in the wild."
  - Highly-vulnerable domains | metric: share of leaked WPAD queries covered by HVDs | prevalence: over 97% of leaked WPAD queries were for HVDs | quote: "We find that over 97% of the leaked WPAD queries are for these HVDs"
  - Registered vulnerable domains | metric: HVD registration percentage | prevalence: approximately 7% to 13% of HVDs were registered across victim ASes | quote: "the registration percentages are in the range of 7% to 13%, which is not high."
  - Active WPAD exploitation | metric: number of valid proxy configuration files found | prevalence: no valid proxy files were found | quote: "We perform such probing several times for all the domains in the union set of the 10 victim ASes' attack surface domains, but are not able to find valid proxy files."
 
# IMC/2016/whois-lost-in-translation-mis-understanding-domain-name-expiration-and-re-regist (2 tuples)
  - domain expiration and re-registration | metric: share of expired domains re-registered | prevalence: about 16.5% observed re-registrations among 6.5 M expired domains | quote: "We carefully filter the collected data to account for various Whois intricacies and perform a survival analysis of 6.5 M expired domains with about 16.5 % observed re-registrations."
  - re-registration timing | metric: fraction re-registered within 300 days | prevalence: around 20 % of expired com domains are re-registered within 300 days | quote: "around 20 % of expired com domains are re-registered within 300 days."
 
# CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study (5 tuples)
  - DNS service-query exposure | metric: average daily query leak volume | prevalence: 115 registered services and 78.5 million non-registered candidate strings | quote: "Before the delegation of a new gTLD... we form the leaked query dataset by extracting queries with (1) NXD responses, and (2) TLD strings that have been delegated"
  - Exposed internal services | metric: number of exposed services | prevalence: 80 services: top 50 registered and 30 non-registered | quote: "we pick the top 50 services for subsequent analysis... we choose 30 service names with top popularity for subsequent analysis."
  - Client-side name-collision vulnerability | metric: vulnerable clients and services | prevalence: 57 clients in 45 of 48 exposed services were vulnerable | quote: "Using the analysis framework, 57 clients in 45 (93.8%) of the 48 exposed services are found to be vulnerable."
  - TLS certificate acceptance vulnerability | metric: share of TLS clients accepting attack certificates | prevalence: 16 of 17 clients accepted previously unseen public certificates by default | quote: "we find that 16 of the 17 clients by default accept the publicly-valid but previously-unseen TLS certificate we prepared for the attack server."
  - PSK server-authentication weakness | metric: share of PSK services and clients vulnerable | prevalence: 37 clients for 30 of 33 services lacked enforced server authentication | quote: "37 clients for 30 (90.9%) out of these 33 services have no enforcement of server authentication."
 
# CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse (8 tuples)
  - combosquatting domains | metric: number of domains | prevalence: 2.7 million combosquatting domains targeting 268 trademarks | quote: "we identify 2.7 million combosquatting domains that target 268 of the most popular trademarks in the US"
  - combosquatting prevalence | metric: relative prevalence | prevalence: combosquatting domains were 100 times more prevalent than typosquatting domains | quote: "we find that combosquatting domains are 100 times more prevalent than typosquatting domains"
  - abusive-domain longevity | metric: share active over 1,000 days | prevalence: almost 60% of abusive combosquatting domains | quote: "almost 60% of the abusive combosquatting domains can be found in our datasets for more than 1,000 days"
  - live combosquatting abuse | metric: successfully crawled domains | prevalence: approximately 1.1 million of 1.3 million domains | quote: "Our crawlers were tracking these changes for four weeks and were able to successfully crawl approximately 1.1 million domains."
  - affiliate abuse | metric: unique domains | prevalence: 2,573 unique domains | quote: "we manually investigate the rest of the redirection chains and identify 2,573 unique domains that were, for at least one day, involved in affiliate abuse."
  - phishing | metric: unique domains | prevalence: 174 domains conducting phishing attacks | quote: "Through this process, we identify 174 domains as conducting phishing attacks."
  - phishing-page candidates | metric: unique domains with login forms | prevalence: 40,299 unique domains | quote: "identify 40,299 unique domains that contain at least one login form."
  - certificate issuance | metric: certificates and domains | prevalence: 691,182 certificates for 107,572 fully-qualified combosquatting domains | quote: "691,182 certificates were given to a total of 107,572 fully-qualified combosquatting domains related to our trademarks"
 
# IMC/2017/email-typosquatting (8 tuples)
  - email typosquatting | metric: annual emails received | prevalence: 118,894,960 emails per year before filtering | quote: "Projecting from the seven months of data collection, our infrastructure receives 118,894,960 emails per year."
  - receiver and reflection typos | metric: annual genuine typo emails | prevalence: 6,041 emails/year estimated after correction | quote: "Correcting, based on our manual analysis, would bring that number further down to 6,041 emails/year being either receiver or reflection typos."
  - SMTP typos | metric: annual emails | prevalence: between 415 and 5,970 SMTP typo emails/year | quote: "Hence we estimate our infrastructure receives between 415 and 5,970 SMTP typo emails/year."
  - sensitive information exposure | metric: emails containing sensitive information | prevalence: Six of 103 manually analyzed emails appeared to contain digital receipts | quote: "six of the 103 emails we analyzed manually appeared to contain digital receipts"
  - SMTP support of typo domains | metric: share of ctypo domains supporting SMTP | prevalence: 43.3% support SMTP | quote: "22.3% of typosquatting domains are not capable of receiving emails, 34.4% did not yield any information, and 43.3% support SMTP."
  - credential or honey-token access | metric: opened or accessed honey emails/tokens | prevalence: 15 emails apparently opened/read and two honey tokens accessed | quote: "our larger measurement to all 7,269 suspected typosquatting domains resulted in 15 emails being apparently opened and/or read by someone, and two honey tokens being accessed."
  - typosquatting infrastructure concentration | metric: share of domains handled by top servers | prevalence: The top eleven SMTP servers handle mail for more than one third of typosquatting domains | quote: "The top eleven SMTP servers handle mail for more than one third of typosquatting domains and 51 for the majority."
  - typosquatting email projection | metric: projected annual emails | prevalence: 846,219 emails, 95% CI 58,460–4,039,500 | quote: "our modified regression analysis yields an expected number of emails received by typosquatters equal to 846,219 with a 95% confidence interval ranging between 58,460 and 4,039,500."
 
# USENIX/2017/game-of-registrars-an-empirical-analysis-of-post-expiration-domain-name-takeover (5 tuples)
  - same-day domain re-registration | metric: share of deleted domains re-registered on deletion day | prevalence: 10.1% of deleted .com domains; 6.6% of .net, 4.7% of .org, and 1.8% of .biz | quote: "10.1 % of all deleted com domains are re-registered on the same day, that is, the earliest possible day for a re-registration."
  - competitive drop timing | metric: share of deletion-day re-registrations within time intervals | prevalence: Over 60% of .org deletion-day re-registrations occurred within one minute; more than half occurred within the first 30 seconds. | quote: "over 60 % of the day's re-registrations occur in the minute between 14:30 and 14:31."
  - drop-catch registrar activity | metric: share of accredited registrars, creation attempts, and successful creations | prevalence: Top three drop-catch services controlled 75% of accredited registrars; drop-catch caused at least 80% of attempts but at most 9.5% of successful .com creations. | quote: "The Top 3, all drop-catch services, control 75 % of accredited registrars."
  - domain tasting | metric: share of deletion-day re-registrations deleted within five days | prevalence: About 2.1% of .com domains re-registered on the deletion date were deleted within five days; SnapNames accounted for over 98%. | quote: "Only about 2.1 % of com domains re-registered on the deletion date ... are deleted within the first five days."
  - uses of re-registered websites | metric: counts in random sample of 50 domains | prevalence: 23 parked or advertising, 9 online-casino advertising, 1 malicious, 2 empty, and 8 failed to load. | quote: "23 are parked and display a "for sale" message or textual advertising; nine sites contain advertising for online casinos, one is malicious, two are empty"
 
# IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri (5 tuples)
  - domain deletion order | metric: null | prevalence: Deletion order was closely approximated by update time and domain ID ordering. | quote: "We conclude that a deletion order exists, and that it is closely approximated by the update time and domain ID ordering."
  - same-day re-registration timing | metric: share of deleted domains | prevalence: 9.5 % of deleted .com domains had a re-registration delay of 0 s. | quote: "About 9.5 % of deleted .com domains are re-registered with a delay of 0 s, that is, in the instant we predict as their deletion time."
  - Drop-period re-registration | metric: share of same-day re-registrations | prevalence: The one-hour period from 7 to 8 pm accounted for 84 % of same-day re-registrations. | quote: "The one-hour period from 7 to 8 pm accounts for 84 % of all same-day domain re-registrations."
  - registrar re-registration behaviour | metric: registrar-cluster delay distribution | prevalence: DropCatch re-registered 99.3 % of its domains with a delay of 0 s within 24 hours. | quote: "DropCatch, the most active re-registration cluster, re-registers 99.3 % of its domains with a delay of 0 s"
  - malicious re-registrations | metric: share labelled malicious | prevalence: 0.4 % of domains re-registered with a delay of 0 s were labelled malicious; fewer than 0.5 % overall. | quote: "Only 0.4 % of domains re-registered with a delay of 0 s are labelled as malicious."
 
# IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild (8 tuples)
  - squatting domains | metric: number and share of domains | prevalence: 657,663 domains; combo squatting comprised 56%. | quote: "In total, we detected 657,663 squatting domains for the 702 target brands."
  - squatting phishing pages | metric: share of squatting domains | prevalence: 1,175 confirmed domains, approximately 0.2% of 657,663 domains. | quote: "As shown in Table 8, after manual examination, we confirmed 1,175 domains are indeed phishing domains."
  - layout obfuscation | metric: image-hash distance | prevalence: Most brands had average distance around 20 or higher. | quote: "most brands have an average distance around 20 or higher, suggesting that layout obfuscation is very common."
  - string obfuscation | metric: share of phishing pages | prevalence: 68.1%–68.2% of squatting pages versus 35.9% of non-squatting pages. | quote: "there is a higher ratio of squatting phishing pages that adopted string obfuscation (68.1%-68.2%) than that of non-squatting phishing pages (35.9%)."
  - code obfuscation | metric: share containing indicators | prevalence: null | quote: "For each phishing page, we download and parse the JavaScript code into an AST (abstract syntax tree). We then use AST to extract obfuscation indicators."
  - blacklist evasion | metric: share undetected for at least a month | prevalence: 91.5% remained undetected by the tested blacklists. | quote: "Collectively these blacklists only detected 8.4% of the squatting phishing pages, which means 91.5% of the phishing domains remain undetected for at least a month."
  - phishing-page lifetime | metric: share remaining alive | prevalence: About 80% remained alive after at least a month. | quote: "Most pages (about 80%) still remain alive after at least a month."
  - IP geolocation | metric: number of IP addresses and countries | prevalence: 1,021 IP addresses across 53 countries. | quote: "In total, we are able to look up the geolocation of 1,021 IP addresses, hosted in 53 different countries."
 
# WWW/2018/panning-for-gold-com-understanding-the-dynamics-of-domain-dropcatching (7 tuples)
  - domain catching after expiration | metric: share of dropped domains caught | prevalence: On average, only 10% of expired domains are caught. | quote: "We find that on average, only 10% of the expired (dropped) domains are caught with the vast majority of the re-registrations happening on the day they are released."
  - malicious-domain registration | metric: relative registration rate | prevalence: Previously malicious domains were registered twice as often as previously benign domains. | quote: "Namely, the rate of registering previously-malicious domains names is twice that of previously benign ones."
  - post-registration malicious reuse | metric: share of previously malicious caught domains remaining malicious | prevalence: 19.9% continued serving malicious content after deletion and re-registration. | quote: "We found that 3,893 of the caught domains had a history of malicious activity and 19.9% of them continued serving malicious content even after deletion and re-registration."
  - benign-domain subversion | metric: number of domains becoming malicious | prevalence: 6,838 domains became malicious after being caught; 94% served malware. | quote: "In total, we observe 6,838 domains that became malicious after being caught. Of these, 6,449 (94%) serve malware."
  - registered-domain usage | metric: share of caught domains by content category | prevalence: 69.2% were parked/ads; less than 10.4% provided real web content. | quote: "The majority of the domains serve advertisements for online casinos or serve parking pages... Less than 10.4% of the domains were used to provide real web content."
  - registrant clustering | metric: share of clusters and registrations | prevalence: Freelancers comprised 98.4% of clusters but registered 12% of dropped domains. | quote: "The majority of the clusters (98.4%) are Freelancers, which in total registered 12% of the dropped domain names."
  - domain deletion timing | metric: days from creation to dropping | prevalence: Most domains were created 445 days before dropping. | quote: "Most domains were created 445 days before their dropping date which means they were registered for one year (365 days), expired, and went through the auto renew phase."
 
# CCS/2019/you-are-who-you-appear-to-be-a-longitudinal-study-of-domain-impersonation-in-tls (6 tuples)
  - target-embedding certificates | metric: unique FQDNs and certificates | prevalence: 256,045 unique FQDNs spanning 435,717 certificates | quote: "After the above filtering, we obtained 256,045 unique FQDNs, comprising 112,262 unique actual domains, 7,581 unique target domains, and spanning 435,717 certificates."
  - user susceptibility to impersonation | metric: participant mistakes | prevalence: 136 participants fell for at least one target-embedding attack | quote: "A total of 136 participants fell for at least one target embedding attack."
  - target-embedding growth | metric: valid certificates over time | prevalence: 3,154 at the beginning of 2016 and 124,432 by the end of the dataset | quote: "At the beginning of 2016, there were only 3,154 target embedding certificates; by the end of our dataset, there are 124,432, an increase of 39.45×."
  - unsafe impersonating domains | metric: fraction flagged unsafe | prevalence: 27,206 of 256,045 Alexa-top-100K target embeddings (10.63%) | quote: "Target Embedding (100K) 256,045 27,206 (10.63%)"
  - wildcard target-embedding capability | metric: unique wildcard domains | prevalence: 343,336 unique wildcard domains | quote: "In total, we observe 343,336 unique wildcard domains whose wildcard is immediately followed by a TLD used in a targeted domain."
  - composed impersonation techniques | metric: overlapping FQDNs | prevalence: 2,442 also combosquatting and 443 also typosquatting | quote: "We discovered 2,442 FQDNs using both target embedding and combosquatting, and 443 FQDNs using both target embedding and typosquatting."
 
# IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs (6 tuples)
  - IDN homographs | metric: number of detected homographs | prevalence: 3,280 IDN homographs out of 955,512 registered .com IDNs | quote: "In total, by using both homoglyph databases, we detected 3,280 IDN homographs, which is approximately eight times more than those detected with UC."
  - Active IDN homographs | metric: reachable domains | prevalence: 1,647 detected IDN homographs responded to HTTP or HTTPS | quote: "We found that the 1,647 IDN homographs we detected were reachable through the HTTP or HTTPS; i.e., roughly half of the detected IDN homographs were active."
  - IDN language distribution | metric: language fraction | prevalence: Chinese 46.5%, Korean 10.6%, Japanese 9.3% | quote: "Table 7 presents the results. We see that east Asian languages (Chinese, Japanese, and Korean) are dominantly used for composing IDNs."
  - Website categories | metric: category counts | prevalence: 693 of 1,647 websites were for business or sale; 338 redirected | quote: "We found that 693 (42%) of the websites running on IDN homographs were used for business ("Domain parking" or "For sale")."
  - Malicious IDN homographs | metric: blacklist matches | prevalence: 242 matched hpHosts, 13 GSB, and 8 Symantec in the combined database | quote: "Table 14 lists the results. By incorporating SimChar into the homoglyph DB, the number of detected malicious IDN homographs increased."
  - Glyph confusability | metric: mean and median confusability score | prevalence: At Δ = 4, mean 3.57 and median 4; at Δ = 5, mean 2.57 and median 2 | quote: "When ∆ = 4, the mean and median of the confusability score were 3.57 and 4, respectively."
 
# NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs (8 tuples)
  - malicious domains taken down | metric: number of seized domains | prevalence: 625,692 seized domains | quote: "As a result, we found 625,692 seized domains and profiled their take-down durations."
  - sinkholed domains | metric: share of seized domains | prevalence: 608,557 confirmed sinkholed domains (96.55%) | quote: "The number of confirmed sinkholed domains was 608,557 (96.55%)"
  - delisted domains | metric: share of seized domains | prevalence: 21,757 delisted domains (3.45%) | quote: "the number of delisted domains was 21,757 (3.45%)."
  - preemptive take-down | metric: share of confirmed sinkholed domains | prevalence: 388,369 (63.81%) were preemptively taken down | quote: "Ultimately, out of the 608,557 confirmed sinkholed domains, we found that 388,369 (63.81%) were preemptively taken down."
  - domain availability after release | metric: released domains in previous ten months | prevalence: 7,148 (14.14%) released back to public registry pools | quote: "7,148 (14.14%) of the domains taken down in the past ten months have been released back to the public registry domain pools."
  - malicious reuse after release | metric: confirmed reuse cases | prevalence: two confirmed cases | quote: "Thus, we found two confirmed cases, which are:"
  - dangling sinkhole DNS | metric: successful takeover | prevalence: successfully hijacked carders.org | quote: "we successfully hijacked the domain and pointed it to an IP under our control."
  - expired sinkhole domains | metric: affected seized domains | prevalence: 29,677 .info domains still pointed to expired sinkholes | quote: "As of July 1, 2018, the total number of seized domains that are still pointing to the three expired sinkholes are 29,677, all belonging to the .info TLD."
 
# CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr (8 tuples)
  - stale SLD NS records | metric: number of PVDs | prevalence: 4,914 PVDs among 1,016,449 scanned domains | quote: "Scanning all these 1,016,449 domains, ZreFinder discovered 4,914 PVDs along with their corresponding SLD stale NS records"
  - hijackable domains | metric: number of hijackable domains | prevalence: 628 domains | quote: "Among the 17 providers studied, 14 allow unauthorized domain claims resulting in 628 PVDs."
  - vulnerability duration | metric: share vulnerable at least 30 days | prevalence: 565 of 628 domains (89.97%) | quote: "565 (89.97%) out of the 628 domains were vulnerable for at least 30 days"
  - resolver cache poisoning | metric: share of responding open resolvers vulnerable | prevalence: 7,044 of 11,072 responding open resolvers (63.62%) | quote: "7,044 are vulnerable to our cache poisoning attack (63.62% of the responding resolvers)."
  - public resolver hijacking | metric: average attempts to receive attacker IP | prevalence: 1 to 28 attempts; average 6.5; median 3 | quote: "a successful attack took 1 to 28 attempts with an average of 6.5 over all affected providers and a median of 3."
  - DNS implementation vulnerability | metric: implementations vulnerable after explicit NS query | prevalence: five of six implementations | quote: "Bind, Unbound, PowerDNS, Microsoft DNS, and DJB dnscache are confirmed to be vulnerable to the Zaw attack when the NS record is explicitly queried for."
  - DNSSEC deployment | metric: properly DNSSEC-signed domains | prevalence: 1 of 628 domains | quote: "only one domain (moodysanalytics.com) was found to deploy DNSSEC properly."
  - cache-miss rate | metric: cache-miss rate | prevalence: nearly 99% at resolvers accepting +norec | quote: "the cache-miss rate for the exploitable domains at these resolvers is nearly 99%."
 
# IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers (5 tuples)
  - Public DNS cache occupancy | metric: relative error in estimated filled caches | prevalence: 10% to −50% error, except one Cloudflare location with 75% error | quote: "Our relative error in estimating the number of filled caches for each resolver varies from 10% to −50%, with the exception of one unusual Cloudflare location where our error is 75%"
  - Stalkerware prevalence | metric: maximum targets observed per TTL epoch | prevalence: minimum of 5,758 people targeted by overt stalkerware in the U.S. | quote: "We estimate that a minimum of 5,758 people are targeted by overt stalkerware in the U.S. today."
  - Contract cheating activity | metric: web requests per day | prevalence: activity decreased for some services toward the end of May | quote: "From May 3-29, 2020, we used Trufflehunter to track activity to these sites."
  - Typo-squatting activity | metric: web requests per day | prevalence: some domains produced dozens of resolutions per day | quote: "We found that some domains were still surprisingly active, with dozens of resolutions per day."
  - Resolver caching architectures | metric: number of independent cache entries | prevalence: GPDNS showed up to several thousand uniquely identifiable caches for one domain | quote: "we observed up to several thousand uniquely identifiable caches for one domain name"
 
# IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations (7 tuples)
  - lame delegations from zone data | metric: affected domains and unresolvable nameservers | prevalence: 4.11 million lame delegated domains | quote: "Unresolvable nameservers may be a small percentage of nameservers (4%), but they result in more than 4.11 M lame delegated domains."
  - active lame delegations | metric: share of queried domains | prevalence: 14.3% had at least one lame delegation | quote: "It shows that more often than not, if a domain has any lame nameserver path, all of its paths do not resolve."
  - lame-delegation persistence | metric: duration in days | prevalence: Some domains were lame for up to 3,000 days | quote: "Some domains are lame for up to 3,000 days, nearly the timeframe of our data set."
  - DNS resolution latency impact | metric: average resolution time | prevalence: Partly lame domains averaged 720 ms versus 172 ms for fully resolvable domains | quote: "For partly lame delegated domains (where a subset of the nameservers are lame), the average resolution time was 720 ms."
  - nameserver hijacking risk | metric: available nameserver domains | prevalence: 42,579 of 48,185 nameserver domains were available for purchase | quote: "Of these nameserver domains, 42,579 (88%) were available for purchase, placing nearly 75,000 domains at risk."
  - authoritative-response inconsistency | metric: share of authoritative nameservers | prevalence: 0.1–0.3% did not reply authoritatively | quote: "In a small percentage of cases (0.1-0.3%) authoritative nameservers do not reply as authoritative, creating lame delegations as a result."
  - parent-child glue inconsistency | metric: inconsistent glue records | prevalence: 5.5–11.4% were inconsistent depending on the TLD | quote: "But from 5.5-11.4%, depending on the TLD, have inconsistent glue records."
 
# IMC/2021/risky-bizness-risks-derived-from-registrar-name-management (7 tuples)
  - sacrificial nameserver creation | metric: number of sacrificial nameservers and affected domains | prevalence: 202,624 sacrificial nameservers impacting 741,413 domains | quote: "Overall we identified more than a dozen registrar renaming idioms that were used to create 202,624 sacrificial nameservers, and ultimately impacted 741,413 domains."
  - hijackable sacrificial nameservers | metric: number of hijackable nameservers and affected domains | prevalence: 180,842 hijackable sacrificial nameservers affecting 512,715 domains | quote: "Affected Domains 512,715 163,827 (31.95%)"
  - domain hijacking | metric: fraction of hijackable nameservers and domains hijacked | prevalence: 9,173 nameservers and 163,827 domains hijacked | quote: "Sacrificial NS 180,842 9,173 5.07% Affected Domains 512,715 163,827 31.95%"
  - time to exploit | metric: CDF of days to exploitation | prevalence: 50% of vulnerable domains hijacked within 5 days; over 70% within a month | quote: "50% of vulnerable domains are hijacked within 5 days of when a sacrificial nameserver is created, and more than 70% of vulnerable domains within a month."
  - hijacked-domain use | metric: qualitative prevalence in 100 screenshots | prevalence: Parking sites dominated the sample. | quote: "Retrospectively, we also analyzed screenshots of 100 random hijacked domains using the Internet Archive Wayback Machine and confirmed that the use of hijacked domains has not changed significantly over time, with parking"
  - DNS hijacking capability | metric: number of experimentally registered domains | prevalence: Five domains registered; queries included .edu and .gov domains. | quote: "We registered five such domains without issue. We then used our own infrastructure and confirmed that we observed incoming queries for the domains"
  - remediation | metric: change from September 2020 to February 2021 | prevalence: 9,757 fewer hijackable nameservers and 13,392 fewer affected domains | quote: "Table 5 shows the change in number of affected nameservers (down 9K from 36K) and domains (down 13K from 54K) roughly five months (Sep 2020 to Feb 2021)"
 
# NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media (6 tuples)
  - unintended URLs | metric: accuracy, precision, recall, and F1 score | prevalence: 26,596 unintended URLs over seven months | quote: "over a period of 7 months, our pipeline identified 26,596 unintended URLs."
  - unintended URLs | metric: share of URLs by DNS status | prevalence: 19,195 (72%) domains were NXDOMAINs and 7,401 (28%) were existing domains | quote: "Overall, 19,195 (72% of the total) domains resulting from unintended URLs are non existent (NXDOMAINs), while 7,401 (28% of the total) domains are existing (XDOMAINs)."
  - URL-rendering behavior | metric: clickable versus not clickable | prevalence: Nine social media and messaging platforms tested | quote: "we test nine popular social media and instant messaging platforms for their automatic URL rendering functionality, applying 23 different test cases to each one."
  - traffic to registered domains | metric: average visitors within one day | prevalence: 103.65 average visitors within one day; maximum 755 visits | quote: "we find that unintended URLs receive an average of 103.65 visitors within one day of appearing in a tweet, with our most popular URL receiving 755 visits."
  - website content | metric: share of crawled websites | prevalence: 42.3% of webpages could expose users to potentially dangerous content | quote: "Thus, we find 42.3% of the webpages in our dataset could expose users to potentially dangerous and unwanted content."
  - blacklisted unintended domains | metric: number of domains | prevalence: 118 target domains and 40 landing domains appeared on at least one blacklist | quote: "In total, 118 target domains and an additional 40 landing domains appear on at least one blacklist reported by VirusTotal [13]."
 
# USENIX/2021/assessing-browser-level-defense-against-idn-based-phishing (8 tuples)
  - IDNs in the .com zone | metric: share of unique .com domains | prevalence: 916,805 IDNs; 0.64% of 143,482,491 unique domain names | quote: "In total, we find 916,805 IDNs. While the percentage is not high (0.64% of all .com domain names)"
  - Script mixing in IDNs | metric: share of IDNs | prevalence: 315,671 (34.4%) of 916,805 IDNs | quote: "Out of the 916,805 IDNs, 315,671 (34.4%) domain names have script mixing."
  - Real-world homograph IDNs | metric: number of homograph IDNs | prevalence: 1,855 homograph IDNs impersonating 674 popular domains | quote: "In total, we identified 1,855 homograph IDNs that impersonate 674 popular domain names."
  - Browser IDN-policy failures | metric: failure rate | prevalence: 20.62% Chrome; 44.46% Firefox; 42.91% Safari | quote: "Only 1,963 out of 9,519 IDNs (20.62%) are displayed in Unicode by Chrome."
  - OCR-based Punycode identification | metric: false-negative and false-positive rates | prevalence: 0% false negatives; below 2% false positives | quote: "Across these browsers, we had a 0% false negative rate and a false positive rate below 2%."
  - User recognition of homograph IDNs | metric: correct-answer rate | prevalence: 48.5% IDN-Block; 55.2% IDN-Pass; 94.6% real domains | quote: "Table 7: Correct answer rates in the main study (6,510 answers): 94.6%, 48.5%, 55.2% for real, IDN-Block, IDN-Pass."
  - IDN display in email services | metric: Unicode display across services | prevalence: Gmail and iCloud displayed homograph IDNs in Unicode | quote: "Gmail (web and mobile) and iCloud (mobile) supported IDN and displayed homograph IDNs in Unicode in the email sender addresses."
  - IDN display in social-network applications | metric: service-level Unicode display | prevalence: Almost all tested services displayed Unicode except Facebook | quote: "We found that almost all of them displayed homograph IDNs in Unicode, except for Facebook (which displayed Punycode)."
 
# USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web (8 tuples)
  - subdomain enumeration | metric: number of valid subdomains | prevalence: 26 million valid subdomains | quote: "Starting from the set of 50k domains in the Tranco list, our framework identified 26 million valid subdomains."
  - subdomain takeover | metric: vulnerable subdomains and domains | prevalence: 1,520 subdomains on 887 domains | quote: "RDScan identified 1,520 subdomains exposed to a takeover vulnerability, distributed among 887 domains from the top 50k of the Tranco list."
  - potentially deprovisioned cloud instances | metric: potentially vulnerable domains | prevalence: 13,532 potentially vulnerable domains | quote: "The analysis of deprovisioned cloud instances discovered 13,532 potentially vulnerable domains"
  - cookie confidentiality and integrity | metric: share of session cookies | prevalence: 3,390 (14%) confidentiality-affected and 24,689 (99%) integrity-affected session cookies | quote: "we identify 3,390 (14%) cookies from 5,051 (33%) domains on 687 sites (81%) whose confidentiality can be violated"
  - CSP vulnerabilities | metric: domains/sites exploitable exclusively by related-domain attackers | prevalence: 139 additional exploitable domains | quote: "related-domain attackers are more powerful than traditional web attackers for real-world CSPs, being able to bypass the protection mechanism on 139 additional domains."
  - CORS misconfiguration | metric: new exploitable cases compared with web attackers | prevalence: 224 (+11%) new cases, including 63 (+54%) with credentials | quote: "we identify 224 (+11%) new exploitable cases, including 63 (+54%) cases with credentials."
  - postMessage vulnerabilities | metric: exploitable domains/sites | prevalence: 14 domains and 11 sites | quote: "our analysis of postMessage shows that all sites suffering from unsafe programming practices are already vulnerable against web attackers"
  - domain relaxation | metric: domains using the mechanism exploitable by related-domain attackers | prevalence: 57 of 97 domains (59%) | quote: "Domain relaxation, instead, can be abused by related-domain attackers in 57 out of 97 domains (59%) making use of this mechanism."
 
# IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust (4 tuples)
  - residual trust traffic | metric: percentage of unique IP addresses | prevalence: At least 50.58% of HTTP(S) IP addresses were tagged trust. | quote: "In summary, we find that at least 50.58% of the IP addresses in our HTTP(S) traffic are unaware of changes in domain ownership and send residual trust traffic to our servers."
  - expired-domain traffic | metric: requests, unique IP addresses, and ASNs | prevalence: 650,737,621 requests from 5,540,379 IP addresses in 22,744 ASes. | quote: "Our honeypot services collected a total of 650,737,621 requests to our re-registered domain servers from 5,540,379 unique IP addresses distributed among 22,744 unique autonomous systems"
  - persistent residual trust | metric: daily unique trust-tagged IP addresses | prevalence: Traffic was not guaranteed to decay during the few-month observation period. | quote: "This suggests that residual trust traffic is not guaranteed to decay over time, or, at least, not within a period of a few months after an expired domain is re-registered."
  - domain service type | metric: share of re-registered domains | prevalence: 128 of 201 domains were confidently categorized. | quote: "Using this method, we were able to confidently categorize 128 domains from our pool of re-registered domains."
 
# IEEE-SP/2022/measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds (6 tuples)
  - IP pool coverage | metric: capture rate | prevalence: 56% of available IP addresses in us-east-1; up to 87% per zone | quote: "In total we estimate that 56% of available IP addresses in the us-east-1 region were measured."
  - IP reuse timing | metric: time before reuse | prevalence: IPs were generally not reused within 30 minutes after release | quote: "IPs were generally not reused within 30 minutes after release."
  - Cloud-service latent configuration | metric: unique IPs and messages | prevalence: Over 5 million messages directed to prior tenants on over 27 thousand IPs | quote: "We received over 5 million messages directed to prior tenants on over 27 thousand IPs that we were assigned from cloud-managed services."
  - Third-party latent configuration | metric: remaining TCP sessions and manually identified service classes | prevalence: Vulnerabilities spanned databases, caches, financial traffic, logging, metrics, webhooks, and tenant APIs | quote: "After all filtering steps were applied, the remaining traffic contained 340 k source IP addresses across 2.95 M TCP sessions."
  - Dangling DNS | metric: unique second-level domains | prevalence: 5446 unique second-level domains spanning 231 unique eTLDs | quote: "The sessions identified 5446 unique second-level domains (SLDs, e.g., example.com), 495 of which had more than one unique subdomain identified."
  - IP-tagging mitigation | metric: unique addresses, previous tenants, and reuse time | prevalence: IP Tagging reduced unique IPs by 99.94% versus random allocation | quote: "Unique IPs are reduced by 99.94%, mean previous tenants by 98.95%, and reuse time is increased by 514 x compared to random allocation."
 
# CCS/2023/iotflow-inferring-iot-device-behavior-at-scale-through-static-mobile-companion-a (8 tuples)
  - IoT endpoint and protocol reconstruction | metric: number of apps with reconstructed endpoints or schemes | prevalence: Schemes reconstructed in 7,113 remote-endpoint apps and 871 local-endpoint apps | quote: "For IoT-VER, we reconstructed schemes in 7,113 unique apps for remote endpoints and in 871 apps for local communication."
  - Direct device communication | metric: share of apps | prevalence: 6,355 apps (64.26%) declared Bluetooth permissions; 1,483 (14.99%) had local IP addresses | quote: "6,355 (64.26%) apps declare at least one Bluetooth permission. We find a local IP address in 1,483 (14.99%) apps"
  - MQTT endpoint reachability | metric: reachable endpoints | prevalence: 74 of 138 remote MQTT endpoints (53.62%) accepted a connection | quote: "We connected successfully (return code 0) to 74 MQTT endpoints (53.62%)."
  - Certificate pinning and expiry | metric: share of apps or certificates | prevalence: 385 apps (3.89%) used pinning; 9,129 certificates (29.18%) were expired in May 2023 | quote: "We use the approach by Pradeep et al. [76] to identify pinning and the corresponding certificates by analyzing the Network Security Configuration (NSC)"
  - Abandoned domains | metric: domains available for registration | prevalence: 67 domains from 73 apps were verified available for registration | quote: "we verified that 67 domains from 73 apps are indeed available for registration."
  - Inter-component data flows | metric: number of flows | prevalence: 497 of 579 Bluetooth flows (85.84%) involved ICC | quote: "Overall, we found 579 flows from Bluetooth sources in 90 apps. Remarkably, 497 (85.84%) of these flows involve ICC"
  - Hard-coded encryption keys | metric: share of apps using encryption | prevalence: 2,321 IoT apps (57.04%) contained reconstructed hard-coded keys | quote: "Overall, we reconstructed hard-coded keys in 2,321 (57.04%) IoT apps and 408 (50.24%) general-purpose apps."
  - Static versus dynamic behavior coverage | metric: matching domains and paths across 13 apps | prevalence: IoTFlow extracted 54 domains and 281 paths versus 40 domains and 160 paths dynamically | quote: "IoTFlow performs better than dynamic analysis and extracts more IoT-related behavior statically from companion apps than dynamic analysis (54 domains and 281 paths vs. 40 domains and 160 paths)"
 
# IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to (8 tuples)
  - NXDomain query prevalence | metric: DNS responses and queried NXDomains | prevalence: 1,069,114,764,701 DNS queries for 146,363,745,785 NXDomains | quote: "In total, we discover 1,069,114,764,701 DNS queries returning NXDomain responses. These DNS queries attempt to obtain the IP addresses of 146,363,745,785 NXDomains."
  - Long-lived NXDomains | metric: number of domains and DNS queries | prevalence: 1,018,964 NXDomains received 107,020,820 queries after more than five years | quote: "We discover 1,018,964 NXDomains receiving a total of 107,020,820 DNS queries as of 2022, while they have been in non-existent status for more than 5 years."
  - DGA-based NXDomains | metric: share of expired NXDomains | prevalence: 2,770,650 potential DGA-based NXDomains, representing 3% of expired NXDomains | quote: "Our result shows 2,770,650 potential DGA-based NXDomains, which represent 3% of all expired NXDomains."
  - Domain squatting | metric: number by squatting type | prevalence: 90,604 expired NXDomains identified as squatting domains | quote: "Within the 91 million expired domains, we discover 90,604 domains that belong to squatting domains."
  - Malicious historical domains | metric: number by malicious category | prevalence: 483,887 NXDomains with historical records of hosting malicious activities | quote: "In total, we uncover 483,887 NXDomains with historical records of hosting malicious activities."
  - Inbound NXDomain traffic | metric: HTTP/HTTPS requests | prevalence: 5,925,311 HTTP/HTTPS requests | quote: "During our 6-month experiment, we gather a total of 5,925,311 HTTP/HTTPS requests to the registered domains."
  - Traffic-source categories | metric: requests by category | prevalence: 4,151,762 automated-process, 1,035,096 user-visit, 422,296 web-crawler, and 315,? referral requests | quote: "we categorize our collected network traffic into four major groups, including web crawler, automated process, referral, and user visits."
  - Malicious HTTP requests | metric: requests and share for qpclick.com | prevalence: 939,420 requests; 98.1% of qpclick.com traffic | quote: "qpclick.com is responsible for 90.8% (939,420 requests) of the malicious HTTP/HTTPS traffic we record."
 
# IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls (5 tuples)
  - key-compromise stale certificates | metric: stale certificates and effective second-level domains | prevalence: 2.42% (286K) of revocations were labeled as key compromise, covering 202K effective second-level domains. | quote: "2.42% (286K) of revocations are labeled as key compromise, which accounts for 202K effective second-level domains."
  - domain-registrant-change staleness | metric: stale certificates and effective second-level domains | prevalence: 7.7M stale certificates affecting 3.6M effective second-level domains. | quote: "In total, we found 7.7M stale certificates (3.6M e2LDs) resulting from a domain registrant change that intersects a valid certificate."
  - managed-TLS departure | metric: stale certificates and effective second-level domains | prevalence: 854K stale certificates representing 695K effective second-level domains over three months. | quote: "Over the course of three months from August 1, 2022 to October 30, 2022, we observed 854K stale certificates representing 695K e2LDs"
  - malicious activity near stale-certificate control | metric: share of sampled domains | prevalence: 1% of 100K randomly sampled domains had malicious activity temporally coinciding with stale certificate control. | quote: "1% of 100K randomly sampled domains have malicious activity that temporally coincides with stale certificate control."
  - certificate-lifetime mitigation | metric: relative staleness-day reduction | prevalence: A 90-day maximum produced 86.7% reduction for registrant change, 75.3% for managed-TLS departure, and 75.2% for key compromise. | quote: "96.7%, 86.7%, and 35.8% reduction for domain registrant change ... 97.7%, 75.3%, and 45.3% decrease for Cloudflare manage TLS departure"
 
# IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d (6 tuples)
  - undelegated DNS records | metric: unique suspicious records | prevalence: 1,580,925 suspicious URs | quote: "We confirmed that 401,718 (25.41%) of the suspicious records are indeed malicious."
  - malicious undelegated records | metric: share of suspicious records | prevalence: 401,718 (25.41%) | quote: "We confirmed that 401,718 (25.41%) of the suspicious records are indeed malicious."
  - Trojan-related activity | metric: share of alerts and tags | prevalence: 41.67% of alerts and 89.01% of tags | quote: "the most prevalent malicious activities (41.67% of alerts and 89.01% of tags) were associated with Trojans"
  - malicious TXT records | metric: share of malicious TXT records | prevalence: 90.95% were email-related DNS records | quote: "90.95% of these records were acting as email-related DNS records (SPF and DMARC)."
  - false-negative classification | metric: false-negative rate | prevalence: zero false-negative rate | quote: "no input is labeled as a suspicious UR, indicating that URHunter achieved a zero false-negative rate."
  - provider hosting policies | metric: providers allowing hosting without verification | prevalence: all seven selected providers | quote: "We found all of the selected reputable hosting providers allowed hosting without verification and facilitated URs."
 
# IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s (8 tuples)
  - Email delivery failures | metric: share of emails | prevalence: 38M (12.93%) emails fail on the first attempt; 14M (4.82%) soft-bounced and 24M (8.11%) hard-bounced. | quote: "Among the 298M emails, 259M (87.07%) are non-bounced, 14M (4.82%) are soft-bounced, and 24M (8.11%) are hard-bounced."
  - Bounce reasons | metric: classifier recall and precision | prevalence: 93.85% recall and 91.24% precision | quote: "Through evaluation, the EBRC achieves 93.85% recall and 91.24% precision."
  - Spam-blocklist bounces | metric: share of bounced emails | prevalence: 10M (31.10%) emails fail because outgoing servers hit spam blocklists. | quote: "We find that 10M (31.10%) emails experience delivery failures due to sender MTAs hitting blocklists."
  - Authentication misconfiguration | metric: share of bounced emails | prevalence: 701K (2.19%) emails are hard-bounced due to sender authentication failure. | quote: "We find that 701K (2.19%) emails are hard-bounced due to sender authentication failure"
  - Email address typos | metric: share of bounced emails | prevalence: 2M (6.85%) emails bounce because of receiver username typos. | quote: "24K senders type username typos resulting in 2M (6.85%) email bounces."
  - Email infrastructure failures | metric: timeout ratio | prevalence: 3M (10.20%) emails experience SMTP session timeout. | quote: "We find that 3M (10.20%) emails experience SMTP session timeout due to network quality issues."
  - Domain squatting risk | metric: number of exploitable domains | prevalence: 3K domain names can be registered for squatting attacks. | quote: "We find 3k domain names that can be registered for squatting attacks, we call them vulnerable domain names."
  - Username squatting risk | metric: share of tested usernames | prevalence: 312 of 875 usernames can be registered for squatting attacks. | quote: "Among the 875 usernames we tested, more than one-third (312) can be registered for squatting attacks"
 
# NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services (8 tuples)
  - Protective DNS deployment | metric: share of probed DNS servers | prevalence: 17,601 servers, 9.1% of all probed | quote: "we identify 17,601 DNS servers (9.1% of all probed) offering such service."
  - DNS response rewriting | metric: rewritten domain-resolution results | prevalence: PDNSes blocked an average of 302 domains in threshold calibration | quote: "PDNSes blocked an average of 302 domain names, while non-PDNSes rewrote 33 domain names."
  - PDNS query latency | metric: round-trip time | prevalence: 70.47% of blocked domains replied within 0.2 seconds without caching | quote: "70.47% of blocked domains would be replied to in less than 0.2 seconds, while that proportion for non-blocked domains is only 44.44%."
  - PDNS traffic adoption | metric: average daily client IP addresses | prevalence: 4,279 clients per day | quote: "On average, there were 4,279 clients per day."
  - Denial of response | metric: resolvers exhibiting DoR | prevalence: All 28 tested potential PDNSes exhibited denial of response | quote: "All 28 PDNS resolvers exhibit denial of response, evidenced by no responses for popular domains in the test experiment"
  - Dangling cloud DNS resources | metric: affected PDNS resolvers | prevalence: 7 obsolete cloud IPs affected 21 PDNSes; one seizable CNAME affected 5 | quote: "Our findings reveal 7 obsolete cloud IPs employed by 21 PDNSes, averaging 279 malicious domain references."
  - PDNS blocking evasion | metric: PDNS servers or vendors | prevalence: 105 PDNSes returned both forged and authoritative answers; 13 vendors returned insecure results for other types | quote: "We observe 105 PDNSes returning both forged ... and authoritative answers for malicious domain queries."
  - DNS rewriting policy distribution | metric: share of identified PDNSes | prevalence: Secure IP rewriting used by 56.45% of PDNSes | quote: "The most prevalent approach, adopted by 56.45% of PDNSes, is to respond with secure IP addresses"
 
# USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure (4 tuples)
  - Shared authoritative nameservers | metric: number of SharedAuth groups and nameservers | prevalence: 2,372 groups; 60,974 SharedAuth-I nameservers and 4,800 SharedAuth-II nameservers | quote: "We identified 2,134 SharedAuth-I groups and 238 SharedAuth-II groups, comprising 60,974 and 4,800 nameservers, respectively."
  - Potentially vulnerable DNS providers | metric: number of vulnerable providers | prevalence: 12 public hosting providers vulnerable to XDAuth attacks | quote: "our analysis identified 12 public hosting providers vulnerable to XDAuth attacks"
  - XDAuth-vulnerable domains | metric: number of vulnerable domains | prevalence: 125,124 domains vulnerable to XDAuth attacks | quote: "we pinpointed 125,124 domains vulnerable to XDAuth attacks."
  - Nameserver response consistency | metric: share of NSs returning consistent results | prevalence: 4,055 of 4,196 NSs (96.6%) returned consistent results | quote: "we collected 4,196 NSs with multiple IPs through multiple measurements at 3 locations and found that 4,055 (96.6%) NSs returned consistent results."
 
# USENIX/2024/rethinking-the-security-threats-of-stale-dns-glue-records (5 tuples)
  - stale DNS glue records | metric: share of actively used glue records | prevalence: 529,197 stale glue records out of 2,283,196 actively used records (23.18%) | quote: "we identified 529,197 stale glue records (504,851 GlueFQDNs) out of 2,283,196 (2,016,516 GlueFQDNs) actively used"
  - potentially exploitable stale glue records | metric: count of potentially exploitable stale glue records | prevalence: 193,558 records mapping to 100,258 cloud IPs | quote: "When the service status of a GlueFQDN is TIMEOUT, and the GlueIP is offline and assignable, we mark it as a potential exploitable stale glue record."
  - unvalidated glue-record use | metric: share of tested implementations using unvalidated glue | prevalence: All nine tested DNS software implementations used glue directly; six used shadow caching. | quote: "Most DNS software cache and use glue records without validation, neglecting to ensure the GlueIP matches the authoritative response for Glue-FQDN"
  - open-resolver glue manipulation | metric: share of stable open resolvers | prevalence: Over 90% exhibited manipulable behavior; 111,766 (12.48%) were vulnerable to denial of service. | quote: "Over 90% of the tested resolvers exhibited manipulable behaviors with glue records"
  - public DNS resolver vulnerability | metric: number of public DNS services vulnerable | prevalence: All 14 were vulnerable to domain takeover; five were vulnerable to the DoS threat model. | quote: "After repetitious experiments, we show that all 14 public DNS are vulnerable to domain takeover"
 
# WWW/2024/hyperlink-hijacking-exploiting-erroneous-url-links-to-phantom-domains (4 tuples)
  - phantom domains and hijackable hyperlinks | metric: share of analyzed .com domains | prevalence: 572,126 phantom domains, approximately 1.3% of 43,020,911 .com domains | quote: "resulting in 572 126 .com phantom domain, representing approximately 1.3% of the .com domains analyzed."
  - publisher URL error modes | metric: percentage of phantom domains by error category | prevalence: 17 error modes identified; 19% had Levenshtein distance greater than five | quote: "17 error modes were identified in the dataset as seen in Table 1."
  - incoming traffic to phantom domains | metric: inbound visits during first week | prevalence: 88.2% of 51 phantom domains exceeded the control domain; median 1,445 visits | quote: "The other 88.2% exceeded the baseline. The median visits to the registered phantom domains amounted to 1445 ± 1262 inbound visits within the first week"
  - source domains of hijackable hyperlinks | metric: relative frequency by source-domain PageRank | prevalence: Hijackable hyperlinks were disproportionately contributed by high-PageRank domains and CMS platforms | quote: "By tracing back from the phantom domains along the edges using data analysis, the source domains which point to phantom domains were uncovered."
 
# IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem (6 tuples)
  - bad NTP timekeeping | metric: share of servers with offset greater than 10 seconds | prevalence: 16.4% of open NTP servers, 0.2% of NTP Pool servers, and 5.0% of refid servers | quote: "16.4% of open NTP servers (1115k), 0.2% of NTP Pool servers (7), and 5.0% of refid servers (1k) are bad timekeepers"
  - NTS-KE misconfiguration | metric: share of NTS-KE servers | prevalence: 64.2% (374 of 583) were misconfigured | quote: "374 (64.2%) NTS-KE servers are misconfigured, hindering their ability to provide time services."
  - synchronization anomalies | metric: share of bad timekeepers | prevalence: 92.1% of bad open NTP timekeepers | quote: "1004.4k (92.1%) open NTP servers ... suffer from synchronization anomalies"
  - low-quality time sources | metric: share of bad timekeepers | prevalence: 6.7% of bad open NTP timekeepers | quote: "73.2k (6.7%) open NTP servers ... use low-quality time sources."
  - single-source vulnerability | metric: share of NTP servers with one upstream | prevalence: 2,024k (29.8%) NTP servers had only a single upstream NTP or NTS-KE server | quote: "2,024k (29.8%) NTP servers are configured with only a single upstream NTP server or NTS-KE server."
  - dangling IP address vulnerability | metric: number of unavailable upstream servers with dangling addresses | prevalence: all approximately 6k unavailable upstream servers had dangling IP addresses | quote: "we first used Zmap [17] to send ICMP echo requests to access host reachability, and then used Nmap [40] to confirm port openness. We find that all the 6k upstream servers have dangling IP addresses."
 
# NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild (8 tuples)
  - Auto-configuration deployment | metric: share of domains | prevalence: 79,212 of 1,053,469 domains (7.52%) supported at least one mechanism. | quote: "Among the 1,053,469 domains scanned, 79,212 (7.52%) domains support at least one auto-configuration mechanism"
  - Server-side security defects | metric: share of supported domains | prevalence: 49,013 domains had security defects; 43,566 Type-I and 11,824 Type-II defects. | quote: "Our analysis discovered a total of 49,013 domains with security defects. For Type-I attacks, we identified defects in 43,566"
  - Insecure configuration retrieval | metric: share of Tranco1M-enabled domains | prevalence: 36,417 Autoconfig domains and 28,902 Autodiscover domains returned configuration insecurely. | quote: "For Autoconfig, ... 84.22% (36,417/43,238) did not redirect to HTTPS URLs."
  - Insecure mail connection settings | metric: number of affected domains | prevalence: 11,824 domains were affected by Type-II threats. | quote: "For Type-II attacks, 11,824 (14.93%) domains were detected"
  - Client auto-configuration defects | metric: share of tested clients | prevalence: 22 of 29 clients were vulnerable to at least one attack scenario. | quote: "Overall, 22/29 clients were vulnerable to at least one of the attack scenarios in Table V."
  - Inadequate client UI notifications | metric: share of tested clients | prevalence: 21 of 29 clients did not prompt users to confirm configuration information. | quote: "Furthermore, 21/29 clients did not prompt users to confirm server configuration information"
  - Back-off query domain hijacking | metric: number of susceptible domains | prevalence: 24,149 domains were susceptible to the Nextcloud Mail attack. | quote: "In total, 24,149 domains were susceptible to this attack, 54 of which were within the top 10K domains in the Tranco ranking."
  - STARTTLS buffering flaws | metric: number of affected servers | prevalence: 128 servers had buffering flaws. | quote: "found 128 servers (including Yandex's) had buffering flaws."
 
# NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange (6 tuples)
  - CrossPUSH and CrossSXG browser vulnerability | metric: share of tested browsers | prevalence: 11 of 14 top-used browsers vulnerable to at least one attack | quote: "11 out of 14 popular browsers, including Chrome and Edge, are vulnerable to at least one of our attacks"
  - Vulnerable mobile applications | metric: qualitative vulnerability status | prevalence: Numerous applications, including Instagram and WeChat, were affected. | quote: "Numerous popular mobile applications, including Instagram and WeChat, are also affected by our attacks"
  - Resold domains | metric: number of domains | prevalence: 11,741 Tranco Top 1M domains | quote: "at least 11,741 Tranco Top 1M domains were once resold within our attack window"
  - Dangling domains | metric: number of domains | prevalence: 4,919 dangling domains | quote: "4,919 dangling domains ... can be compromised by us and we can launch CrossPUSH to these websites even for two years"
  - Certificate-sharing exposure | metric: share of Tranco Top 1K domains | prevalence: 829 domains, or 82.9%, were cert-sharing domains | quote: "829 (82.9%) of Tranco Top 1K domains are cert-sharing domains that are suffering security downgrades."
  - CDN HTTP/2 push support | metric: number of CDNs examined | prevalence: Nine prominent CDNs investigated; support varied substantially. | quote: "To evaluate this phenomenon, we investigate nine prominent CDNs and find that HTTP/2 features have not been well-supported."
 
# NDSS/2025/the-guardians-of-name-street-studying-the-defensive-registration-practices-of-the-fortune-500 (4 tuples)
  - defensive domain registration | metric: share of generated domains and companies | prevalence: 19,523 domain names defensively registered by 447 Fortune 500 companies | quote: "Overall, we identified 19,523 domain names defensively registered by 447 Fortune 500 companies."
  - domain-name transformations | metric: number of generated candidates | prevalence: 146,397,537 candidate domain names across 383 gTLDs | quote: "The breadth of types allows us to conduct an analysis of defensive registrations spanning more than 146 million potential domain names across 383 gTLDs."
  - passive-DNS traffic coverage | metric: median share of traffic captured | prevalence: 78% to over 94%, depending on provider | quote: "The median share of traffic received by defensively registered domains ranges from 78% (Network Solutions) to over 94% (SafeNames)."
  - provider registration strategies | metric: recall and similarity at K | prevalence: Models predicted 80% of registrations while examining under 10% of candidate space for almost every provider | quote: "Our models correctly predicted 80% of the registrations of almost every provider while going through less than 10% of the available space of candidates."
 
# NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem (8 tuples)
  - Deno attack-surface vulnerabilities | metric: affected or partially mitigated security concerns | prevalence: Most listed Node.js security issues still affect Deno. | quote: "we surveyed related work on Node.js security and attempted to implement proof-of-concept payloads, for each known issue, to verify if Deno is also affected by it."
  - Unavailable dependency URLs | metric: number of unavailable URLs and affected packages | prevalence: Median 220 unavailable links; 380 directly affected packages and 462 transitively affected packages. | quote: "We consider any status code other than status_code=200 as a sign of unavailability."
  - Insecure HTTP imports | metric: packages using HTTP imports | prevalence: 39 packages were transmitted via HTTP. | quote: "We find that 39 packages in our dataset are transmitted via HTTP, while 4,686 packages are imported via HTTPS protocol."
  - Domain takeover risk | metric: domains at takeover risk | prevalence: One of 21 domains was available for sale. | quote: "one of these domains is even available for sale for a low price, since early February 2023."
  - Unlocked dependency versions | metric: share of URLs without locked versions | prevalence: 13% of 10,544 URLs were not locked to specific package versions. | quote: "We find that 13% of the total URLs are not locked to specific package versions."
  - Mutable package versions | metric: domains permitting mutation | prevalence: Five of the top 16 domains allowed changing an exact package version. | quote: "We find that among the top 16 domains, five domains allow to change the the exact version of a package."
  - Documented permissions | metric: packages documenting permissions | prevalence: 1,123 packages documented required permissions; 53 used fine-grained permissions. | quote: "We find that 1,123 packages document the required permissions, out of which 53 use fine-grained permissions."
  - Code-implied permissions | metric: packages requiring permissions | prevalence: Network APIs occurred in 237 packages directly and 2,714 packages including dependencies. | quote: "We only infer the presence of network-related API calls in 237 packages, but in the dependency code of 2,714 packages."
 
# USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps (5 tuples)
  - DNS footprints | metric: average eTLD+1s per APK | prevalence: 7.4 eTLD+1 first- and second-order domains per APK on average | quote: "We extract the footprint of each APK, and find that the supply chain attack surface of apps consists of 7.4 eTLD+1 first- and second-order domains, on average."
  - Expired domain dependencies | metric: share of APKs or apps affected at any time | prevalence: 2.5% of APKs and 4.2% of apps | quote: "On average, 2.5% of all APKs, or 4.2% of all apps, in our data use at least one expired domain at any time."
  - Immediately registrable domains | metric: number of immediately registrable domains | prevalence: 41 domains in 309 APK versions from 149 apps | quote: "We discovered 41 expired domains - which we verified to be immediately registrable by asking a registrar - in the dependencies of apps at runtime."
  - Footprint changes across updates | metric: share of apps with large footprint changes | prevalence: 29% of apps experienced changes approximately equal to the average footprint size | quote: "over the course of 9 updates, the number of changes to the footprints of 29% of apps is approximately equal to the overall average app footprint size."
  - Emulator-dependent footprints | metric: additional unique domains | prevalence: 401 additional unique domains, or 4.21% | quote: "This corresponds to contributing an additional 4.21% to the set of domains."
 
# USENIX/2025/misty-registry-an-empirical-study-of-flawed-domain-registry-operation (4 tuples)
  - twin domain takeover | metric: number and percentage of vulnerable twin domains | prevalence: 6,017 (6.17%) vulnerable twin domains among 97,542 IDNs | quote: "Among the 97,542 IDNs in twin domain groups, we identified 70,242 (72.01%) exhibited domain resolution inconsistencies and 6,017 (6.17%) vulnerable twin domains"
  - stale glue records | metric: number of exploitable records and affected domains | prevalence: 80,251 exploitable stale glue records affecting 1,600,253 domains | quote: "We identified 184,308 exploitable stale glue records serving 6,068,353 domain names. Of these, 80,251 (43.54%) lacked in-domain delegation, affecting 1,600,253 (26.37%) domain names."
  - relic domains | metric: number of resurrected and untapped relic domains | prevalence: 19 resurrected and 3,425 untapped relic domains | quote: "We identified 19 resurrected relic domains involving 13 TLDs... We discovered 3,425 untapped relic domain names involving 11 new gTLDs"
  - fraudulent twin-domain websites | metric: number of fraudulent domains | prevalence: 1,249 fraudulent twin domains among S3 inconsistencies | quote: "Further, we examined the HTTP responses of these twin domains and found that 1,249 of them were fraudulent. Specifically, we confirmed that they were abused and had deployed sophisticated cloaking technologies"
 
# NDSS/2026/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles (8 tuples)
  - Forum shopping | metric: share of disputes | prevalence: 26,977 disputes; 29.92% of all disputes analyzed | quote: "forum shopping may have affected 26,977 disputes-33.98% of disputes involving legal representatives and 29.92% of all disputes analyzed."
  - Panelist conflicts of interest | metric: number of overlapping cases | prevalence: Nine disputes involving eight complainants | quote: "We observed this in nine disputes filed by eight complainants and decided by panelists whose law firm later represented the same complainants"
  - Delayed registrar confirmation | metric: share of late responses | prevalence: 927 responses (7.14%) were late from January 2020 onward | quote: "927 responses (7.14%) were late by one to twelve business days"
  - Delayed panel appointment | metric: share of panels appointed late | prevalence: Up to 88.53% of panels; delays of 1–48 days | quote: "Up to 88.53% of panels were appointed late, with delays ranging between 1 and 48 days."
  - Delayed panel decisions | metric: additional days when late | prevalence: Late decisions took up to 31 additional days | quote: "some repeatedly submitted decisions beyond the 14-day window, taking up to 31 additional days."
  - Premature domain transfer | metric: share of disputed domains | prevalence: 339 domains (1.14%) from 172 disputes transferred early | quote: "we found 339 disputed domains (1.14%) from 172 disputes with an early transfer date"
  - Delayed domain transfer | metric: transfer delay in business days | prevalence: Median 24 business days; 2,751 malicious domains remained active up to four months | quote: "slow processing allowed 2,751 domains flagged as malicious by VirusTotal to remain active for up to 4 months after a transfer decision was issued."
  - Trademark transformation types | metric: share of disputed domains classified | prevalence: 150,206 domains (85.70%) classified | quote: "we extracted the complainants' trademarks from the proceedings and subsequently classified 150,206 (85.70%) disputed domain names"
 
# PETS/2026/dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android (6 tuples)
  - sensitive identifier transmission | metric: number of apps, endpoints, and identifiers observed | prevalence: 11,131 apps dynamically analyzed | quote: "We scan decoded payloads (JSON, XML, Protobuf, and URL-encoded) for all these values using string matching and regular expressions—including their MD5, SHA-1, and SHA-256 hashes"
  - late domain renewal | metric: share of monitored domains with positive downtime | prevalence: 25.3% of domains were renewed after expiration | quote: "Overall, 25.3% of domains renewed after expiration"
  - dangling CNAMEs | metric: share of late-renewed domains with dangling CNAMEs | prevalence: 218 of 861 late-renewed domains (25.3%) | quote: "During their expired periods, 218 of the 861 domains (25.3%) exhibited at least one dangling CNAME record"
  - TLS certificate issuance gaps | metric: share of TLS-enabled late-renewed domains with issuance lag | prevalence: 146 domains (17.0%) exhibited post-renewal issuance delay | quote: "Among the TLS-enabled domains, 146 (17.0%) exhibited a post-renewal issuance delay"
  - TLS lifetime mismatch | metric: share of TLS-enabled late-renewed domains with mismatch | prevalence: 607 cases (70.5%) | quote: "In 607 cases (70.5%), the certificate's expiration date preceded the renewed domain's expiration"
  - Certificate Transparency issuance during downtime | metric: domains receiving certificates during lapse | prevalence: 34 domains received 91 unique certificates | quote: "Of the 218 domains, 34 (15.6%) received at least one certificate during their lapse (91 unique certificates in total"
 
300 detection tuples across 48 IN papers; papers with none: 0
 
=== PASS L — CONTEXT papers (reading list, not population), by code ===
 
other-namespace (14): squatting or lifecycle abuse in a non-DNS namespace (packages, containers, apps, skills, handles, blockchain names, addresses)
  2018 USENIX/2018/skill-squatting-attacks-on-amazon-alexa — voice-skill squatting
  2019 IEEE-SP/2019/dangerous-skills-understanding-and-mitigating-security-risks-of-voice-controlled — voice squatting
  2019 NDSS/2019/life-after-speech-recognition-fuzzing-semantic-misinterpretation-for-voice-assistant-applications — voice-app squatting
  2020 WWW/2020/mobile-app-squatting — app identifier squatting
  2021 NDSS/2021/hey-alexa-is-this-skill-safe-taking-a-closer-look-at-the-alexa-skill-ecosystem — skill squatting
  2022 IMC/2022/challenges-in-decentralized-name-management-the-case-of-ens — ENS squatting and persistence
  2022 USENIX/2022/exploring-the-unchartered-space-of-container-registry-typosquatting — container-registry typosquatting (decision: pointer)
  2023 IEEE-SP/2023/investigating-package-related-security-threats-in-software-registries — package-registry typosquatting and dangling references
  2023 USENIX/2023/beyond-typosquatting-an-in-depth-look-at-package-confusion — npm package-name confusion
  2024 IMC/2024/panning-for-gold-eth-understanding-and-analyzing-ens-domain-dropcatching — ENS dropcatching (decision: pointer)
  2024 USENIX/2024/the-imitation-game-exploring-brand-impersonation-attacks-on-social-media-platfor — social-media handle squatting
  2024 WWW/2024/investigations-of-top-level-domain-name-collisions-in-blockchain-naming-services — blockchain naming-service TLD collisions
  2025* USENIX/2025/blockchain-address-poisoning — lookalike wallet addresses
  2025* WWW/2025/beyond-visual-confusion-understanding-how-inconsistencies-in-ens-normalization-f — ENS normalisation and homoglyphs
 
uses (5): a lookalike or re-registered name is only the vehicle; the phishing / scam / fraud it carries is the object
  2015 IMC/2015/affiliate-crookies-characterizing-affiliate-marketing-abuse — cookie-stuffing affiliate fraud, often through typosquatted domains; the fraud is the object
  2017 NDSS/2017/dial-one-for-scam-a-large-scale-analysis-of-technical-support-scams — typosquatting domains as a malvertising seed for tech-support scams (security:online_scams)
  2021 USENIX/2021/catching-phishers-by-their-bait-investigating-the-dutch-phishing-landscape-throu — phishing kits found via CT; lookalike names as the vehicle
  2021 WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems — typosquatting sites as one of four traffic sources for TDS
  2026* NDSS/2026/ctphishcapture-uncovering-credential-theft-based-phishing-scams-targeting-cryptocurrency-wallets — wallet phishing; typosquatted names as the vehicle
 
registration-data (4): WHOIS/RDAP, zone files, registrar or registry operation as the instrument or object
  2015 IMC/2015/who-is-com-learning-to-parse-whois-records — WHOIS parsing at .com scale — the instrument
  2021 NDSS/2021/from-whois-to-whowas-a-large-scale-measurement-study-of-domain-registration-privacy-under-the-gdpr — GDPR redaction of WHOIS, 1.2B records — the instrument
  2024 CCS/2024/characterizing-and-mitigating-phishing-attacks-at-cctld-scale — registry-side view of phishing registrations in three ccTLDs
  2024 IMC/2024/darkdns-revisiting-the-value-of-rapid-zone-update — transient domains invisible to daily zone snapshots — source coverage
 
malicious-domains (8): malicious-domain detection, DGA, registration-time detection, takedown, sinkholing
  2010 IMC/2010/detecting-algorithmically-generated-malicious-domain-names — DGA / domain-fluxing detection
  2016 CCS/2016/predator-proactive-recognition-and-elimination-of-domain-abuse-at-time-of-regist — registration-time detection of spam domains from registry logs
  2016 USENIX/2016/a-comprehensive-measurement-study-of-domain-generating-malware — DGA families; registration and parking of DGA domains
  2017 IEEE-SP/2017/a-lustrum-of-malware-network-communication-evolution-and-insights — malware C&C domains, including expired ones
  2018 USENIX/2018/schrodinger-s-rat-profiling-the-stakeholders-in-the-remote-access-trojan-ecosyst — sinkholed expired RAT controller domains to count victims
  2020 NDSS/2020/a-practical-approach-for-taking-down-avalanche-botnets-under-real-world-constraints — classifying registered DGA domains for a takedown
  2021 USENIX/2021/compromised-or-attacker-owned-a-large-scale-classification-and-study-of-hosting — compromised vs attacker-owned hosting domains of malicious URLs
  2026* NDSS/2026/indicator-of-benignity-an-industry-view-of-false-positive-in-malicious-domain-detection-and-its-mitigation — false positives in malicious-domain detection
 
dns-attack (4): hijacking via resolver, cache or registrar-account attacks; resolver behaviour (design:dns)
  2012 NDSS/2012/ghost-domain-names-revoked-yet-still-resolvable — revoked domains kept alive by resolver caches — resolver behaviour
  2021 USENIX/2021/the-hijackers-guide-to-the-galaxy-off-path-taking-over-internet-resources — off-path DNS attacks to take over registrar and RIR accounts
  2022 IMC/2022/retroactive-identification-of-targeted-dns-infrastructure-hijacking — targeted DNS infrastructure hijacks found in scans and CT
  2023 NDSS/2023/ghost-domain-reloaded-vulnerable-links-in-domain-name-delegation-and-revocation — resolver implementations keep revoked delegations alive
 
search-abuse (2): search poisoning on misspellings, wildcard-DNS spam
  2016 USENIX/2016/the-ever-changing-labyrinth-a-large-scale-analysis-of-wildcard-dns-powered-black — wildcard-DNS blackhat SEO
  2019 IEEE-SP/2019/measuring-and-analyzing-search-engine-poisoning-of-linguistic-collisions — search poisoning of misspelled search terms
 
user-study (1): people judging lookalike URLs
  2025* USENIX/2025/url-inspection-tasks-helping-users-detect-phishing-links-in-emails — users inspecting lookalike URLs
 
mention-check (3): a takeover / expiry check inside a broader audit, no in-the-wild count
  2025* NDSS/2025/misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shortening-service — subdomain-takeover / expiry checks on allow-listed domains, no in-the-wild count
  2025* NDSS/2025/secure-ip-address-allocation-at-cloud-scale — simulated IP-allocation policies against IP reuse; no in-the-wild measurement
  2026* USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web — related-origin registrability checked on an audited sample; subdomain takeover as exposure
 
=== PASS M — the 2026-09-22 gap-pass claim, re-derived ===
Claim: ">=5 hits: 85 papers, 47 web, 25 from 2024-2026". As run here on paper.norm.txt: 85 papers, 47 web, 25 from 2024–2026.
IN papers from 2024–2026: 14 of 48 (primary 8); CONTEXT from 2024–2026: 13 of 41.

verify_domain_abuse_figures-output.txt

control ok (mutated needle not located)  2017/CCS/hiding-in-plain-sight  "combosquatting domains are 10 times more prevalent than typosquatting domains"
control ok (mutated needle not located)  2022/IEEE-SP/domains-do-change-their-spots  "merely by spending an average of $7.92 for the registration of each expired domain"
control ok (mutated needle not located)  2021/USENIX/can-i-take-your-subdomain  "RDScan identified 1,250 subdomains exposed to a takeover vulnerability"
OK   paper.cols.txt 2017/CCS/hiding-in-plain-sight  | box/read-first: 2.7M, 268 trademarks
       "we identify 2.7 million combosquatting domains that target 268 of the most popular trademarks in the US"
OK   paper.cols.txt 2017/CCS/hiding-in-plain-sight  | box: 100 times
       "combosquatting domains are 100 times more prevalent than typosquatting domains"
OK   paper.cols.txt 2017/CCS/hiding-in-plain-sight  | use section: affiliate redirect to the target
       "redirect users to their intended destination but add an affiliate identifier"
OK   paper.cols.txt 2025/NDSS/the-guardians-of-name-street  | box: 146M -> 402,934 -> 19,523 (4.84%) (Table II final row)
       "Overall 146,397,537 402,934 19,523 (4.84%)"
OK   paper.cols.txt 2025/NDSS/the-guardians-of-name-street  | box: 19,523 defensive
       "we identified 19,523 domain names defensively registered by 447 Fortune 500 companies"
OK   paper.cols.txt 2015/NDSS/seven-months-worth  | box: 156 of top 500
       "only 156 of the authoritative domains in our list have defensive domain registrations"
OK   paper.cols.txt 2015/NDSS/seven-months-worth  | use table: 344 (68.8%)
       "344 domains (representing 68.8% of the 500 most popular sites of the Internet) have no defensive registrations whatsoever"
OK   pypdf          2015/NDSS/seven-months-worth  | use table: 477 of 500
       "Out of these 500 domains, 477 have at least one malicious typosquatting domain"
OK   paper.cols.txt 2015/NDSS/seven-months-worth  | use table: 28,179 / 17,172
       "In total, 28,179 potential typosquatting domains were generated, out of which 17,172 resolved to an IP address at least once during our study"
OK   paper.cols.txt 2015/NDSS/seven-months-worth  | generation: DL distance 1
       "Damerau-Levenshtein distance of one"
OK   paper.cols.txt 2015/NDSS/seven-months-worth  | generation: single typo only
       "We also limit ourselves to domains resulting from a single application of one of these models"
OK   paper.cols.txt 2015/NDSS/seven-months-worth  | generation: wrong TLD excluded
       "e.g., a wrong domain TLD"
OK   pypdf          2022/IEEE-SP/domains-do-change-their-spots  | box: $7.29
       "merely by spending an average of $7.29 for the registration of each expired domain"
OK   pypdf          2022/IEEE-SP/domains-do-change-their-spots  | box: 650,737,621 / 5,540,379
       "650,737,621 requests from 5,540,379 unique IP addresses"
OK   paper.cols.txt 2022/IEEE-SP/domains-do-change-their-spots  | box: four months
       "over a four-month period"
OK   paper.cols.txt 2022/IEEE-SP/domains-do-change-their-spots  | box/ethics: 201
       "to the 201 re-registered domains"
OK   pypdf          2022/IEEE-SP/domains-do-change-their-spots  | ethics: expired back into the pool
       "all our registered domains had already expired and were returned to the pool of domains available for re-registration"
OK   pypdf          2022/IEEE-SP/domains-do-change-their-spots  | ethics: never engaged
       "we never engaged with clients to further advance the communication"
OK   pypdf          2022/IEEE-SP/domains-do-change-their-spots  | ethics: 404 page with bot traps and fingerprinting
       "custom 404 HTTP(S) page that delivers our bot traps and JavaScript fingerprinting code"
OK   paper.cols.txt 2017/USENIX/game-of-registrars  | box/expiry: 10%
       "We find that 10 % of all com domains are re-registered on the same day as their old registration is deleted"
OK   paper.cols.txt 2017/USENIX/game-of-registrars  | expiry: 75/80/9.5
       "drop-catch services control over 75 % of accredited domain registrars and cause more than 80 % of domain creation attempts, but represent at most 9.5 % of successful domain creations"
OK   paper.cols.txt 2021/IMC/risky-bizness  | box: 512,715 / 163,827 (31.95%) (Table 3)
       "Affected Domains 512,715 163,827 31.95%"
OK   paper.cols.txt 2021/IMC/risky-bizness  | ethics: 5 domains
       "we registered five such domains without issue"
OK   paper.cols.txt 2021/IMC/risky-bizness  | ethics: never respond (quote)
       "while being careful to never respond"
OK   paper.cols.txt 2021/IMC/risky-bizness  | ethics: counsel
       "we conferred with campus general counsel"
OK   paper.cols.txt 2021/IMC/risky-bizness  | ethics: logs deleted
       "deleting all log data"
OK   paper.cols.txt 2014/USENIX/the-long-taile  | generation: ~20% of .com
       "20% of the total domain set are true typo domains"
OK   paper.cols.txt 2014/USENIX/the-long-taile  | generation: 6.8%
       "only 6.8% target the 10,000 most popular .com domains"
OK   paper.cols.txt 2013/WWW/bitsquatting  | generation: 5,366
       "In a nine-month period, we recorded a total of 5,366 unique bitsquatting domains"
OK   paper.cols.txt 2013/WWW/bitsquatting  | generation: 491 of top 500 (sentence is column-spliced after "5,366")
       "bitsquatting domains targeting 491 out of the Alexa"
OK   paper.cols.txt 2013/WWW/bitsquatting  | generation: 71.8%
       "3,854 or 71.8% of the bitsquatting domains are not typosquatting domains"
OK   paper.cols.txt 2013/WWW/bitsquatting  | generation: 270 days
       "In the period of 270 days"
OK   paper.cols.txt 2019/IMC/shamfinder  | generation: SimChar
       "build a new homoglyph database named SimChar"
OK   paper.cols.txt 2019/IMC/shamfinder  | target list: Alexa top 10K .com
       "we extracted the top-10K of .com domains from the Alexa ranking list"
OK   paper.cols.txt 2021/USENIX/assessing-browser-level  | generation: 1,855 / 674
       "In total, we identified 1,855 homograph IDNs that impersonate 674 popular domain names"
OK   paper.cols.txt 2021/USENIX/assessing-browser-level  | generation: 64.1 / 9.7 / 6.1
       "Chrome displays Punycode for 1,189 homograph IDNs (64.1%); Safari and Firefox only display Punycode for 180 (9.7%) and 113 (6.1%) of them"
OK   paper.cols.txt 2021/NDSS/to-err-is-human  | generation: 26,596
       "recording a total of 26,596 unintended URLS"
OK   paper.cols.txt 2021/NDSS/to-err-is-human  | generation: g-20.in example
       "caused Twitter to interpret that part of the sentence (g-20.in) as a URL"
OK   paper.cols.txt 2021/NDSS/to-err-is-human  | ethics: 45 domains
       "register a total of 45 domains, within hours after they were tweeted by popular accounts"
OK   paper.cols.txt 2021/NDSS/to-err-is-human  | ethics: quote
       "we do not interact in any way with the users"
OK   paper.cols.txt 2021/NDSS/to-err-is-human  | ethics: IRB
       "this research is not considered as human subjects research by our institution"
OK   paper.cols.txt 2018/IMC/needle-in-a-haystack  | tools + use table: 224M / 657K / 702
       "we scanned five types of squatting domains over 224 million DNS records and identified 657K domains that are likely impersonating 702 popular brands"
OK   paper.cols.txt 2018/IMC/needle-in-a-haystack  | use table: >90%
       "More than 90% of them successfully evaded popular blacklists for at least a month"
OK   paper.cols.txt 2018/IMC/needle-in-a-haystack  | use table: 1,175
       "1,175 squatting phishing pages"
OK   paper.cols.txt 2018/IMC/needle-in-a-haystack  | use table: 657,663
       "657,663 squatting domains"
OK   paper.cols.txt 2024/IMC/darkdns  | sources: DarkDNS quote
       "the daily snapshots miss at least 1% of newly registered and short-lived domains, which are frequently registered with likely malicious intent"
OK   paper.cols.txt 2024/IMC/darkdns  | sources: one third (pypdf splits "one-third")
       "we detected only onethird of these transient domains even with the best public available data"
OK   paper.cols.txt 2020/IMC/unresolved-issues  | dangling table: 14%
       "roughly 14% of registered domains that we actively measured had at least one lame delegation"
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/HotCRPNumberTime', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 48, '/FontDescriptor': IndirectObject(604, 0, 262425773671696), '/LastChar': 57, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500, 500, 500, 500, 500, 500, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
OK   pypdf          2020/IMC/unresolved-issues  | dangling table: 49M
       "we queried over 49 million domains"
OK   paper.cols.txt 2020/IMC/unresolved-issues  | dangling table: 88%
       "42,579 (88%) were available for purchase"
OK   pypdf          2020/IMC/unresolved-issues  | dangling table: 48,185 / 151,422 (review G1 denominator)
       "there were 70,605 nameservers under 48,185 unique registered domains used by 151,422 lame delegated domains"
OK   paper.cols.txt 2015/NDSS/seven-months-worth  | use: 2.84 transitions per domain (review G19)
       "we get a value of 2.84"
OK   paper.cols.txt 2023/IMC/dial-n-for-nxdomain  | residual: selection rule (review G8)
       "have been in NXDomain status for at least 6 months"
OK   paper.cols.txt 2026/NDSS/repairing-trust-in-domain-name  | LLM paragraph: GPT-4o in the address pipeline (review G18)
       "leveraged a large language model (GPT-4o)"
OK   paper.cols.txt 2021/USENIX/assessing-browser-level  | target list: Hu et al. top 10K (review G4)
       "we select the domain names from Alexa top 10,000 domains"
OK   paper.cols.txt 2019/CCS/you-are-who-you-appear  | target list: Roberts et al. top 100K (review G4)
       "from within the Alexa top-100K most popular"
OK   paper.cols.txt 2014/USENIX/the-long-taile  | target list: Szurdi et al. head/mid/tail (review G4)
       "we split the Alexa list into three categories"
OK   paper.cols.txt 2020/IMC/unresolved-issues  | ethics refusal quote
       "which would raise its own ethical issues if we could"
OK   paper.cols.txt 2021/NDSS/from-whois-to-whowas  | WHOIS: 85% quote
       "over 85% surveyed large WHOIS providers redacting EEA records at scale"
OK   paper.cols.txt 2021/NDSS/from-whois-to-whowas  | WHOIS: 60% quote
       "over 60% large WHOIS data providers also redact non-EEA records"
OK   paper.cols.txt 2021/NDSS/from-whois-to-whowas  | WHOIS: 1.2 billion
       "1.2 billion WHOIS records"
OK   paper.cols.txt WEAK 2015/IMC/who-is-com  | WHOIS: learned parser (title)
       "Who is .com?"
OK   paper.cols.txt 2018/IMC/from-deletion-to-re-registration  | WHOIS: RDAP test deployment
       "We collected them from Verisign's RDAP test deployment [3], and fell back to Whois lookups in the rare case of errors"
OK   paper.cols.txt 2018/IMC/from-deletion-to-re-registration  | WHOIS: HTTP 500
       "resulted in HTTP 500 errors from the RDAP server"
OK   paper.cols.txt 2018/IMC/from-deletion-to-re-registration  | expiry: 19:00 UTC
       "registered before 7 pm UTC"
OK   paper.cols.txt 2016/IMC/whois-lost-in-translation  | WHOIS: historical archives quote
       "the companies do not disclose when and how they collect the data"
OK   paper.cols.txt 2026/NDSS/repairing-trust-in-domain-name  | WHOIS/UDRP: 2,751 quote
       "2,751 malicious domains remained under malicious actors"
OK   paper.cols.txt 2026/NDSS/repairing-trust-in-domain-name  | WHOIS/UDRP: four months
       "control for up to four months after a panel ordered their transfer"
OK   paper.cols.txt WEAK 2026/NDSS/repairing-trust-in-domain-name  | WHOIS/UDRP: 90,153 proceedings
       "90,153"
OK   paper.cols.txt 2015/IMC/from-academy-to-zone  | use table: 31.9%
       "We discovered 1,161,892 parked domains in our data set, or 31.9% of all domains in the zone files"
OK   paper.cols.txt 2015/IMC/from-academy-to-zone  | use table: 15%
       "only 15% of domains in the new TLDs show characteristics consistent with primary registrations, while the rest are promotional, speculative, or defensive in nature"
OK   paper.cols.txt 2015/IMC/from-academy-to-zone  | use table: 3,638,209
       "Out of 3,638,209 domains in the new TLDs"
OK   paper.cols.txt 2015/NDSS/parking-sensors  | use table: 15 / 8M
       "We identify 15 popular parking services and retrieve a corpus of more than 8 million parked domains"
OK   paper.cols.txt 2015/NDSS/parking-sensors  | use table: 60%
       "60% of the discovered domains are parked with the three most popular services"
OK   paper.cols.txt 2015/NDSS/parking-sensors  | use table: 131,673 (1.63%)
       "found a total of 131,673 typosquatting domains (1.63%)"
OK   paper.cols.txt 2015/NDSS/parking-sensors  | use: Random Forest
       "we opt for the Random Forest algorithm"
OK   paper.cols.txt 2015/NDSS/parking-sensors  | use: features
       "In total, we construct eleven HTML features, five HAR features, four frame features and one domain feature"
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 49, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 117, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 722, 0, 0, 0, 0, 389, 0, 0, 0, 0, 0, 0, 611, 0, 0, 556, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 556, 444, 556, 444, 333, 500, 556, 278, 0, 556, 0, 833, 556, 500, 556, 0, 444, 389, 333, 556]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 833, 0, 0, 333, 333, 0, 0, 250, 333, 250, 0, 500, 500, 500, 500, 500, 500, 0, 500, 0, 500, 278, 0, 0, 0, 0, 0, 921, 722, 667, 667, 722, 611, 556, 0, 722, 333, 0, 722, 611, 889, 0, 722, 556, 0, 667, 556, 611, 722, 0, 944, 722, 722, 611, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMSY10', '/Encoding': IndirectObject(285, 0, 249231333013008), '/FirstChar': 30, '/FontDescriptor': IndirectObject(286, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 97, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 500, 444, 0, 500, 0, 278, 0, 444, 0, 722, 500, 500, 500, 0, 389, 389, 278, 0, 0, 0, 0, 0, 389]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 83, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 111, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 833, 0, 0, 333, 333, 0, 0, 250, 333, 250, 278, 500, 500, 500, 0, 500, 500, 0, 0, 0, 0, 278, 278, 0, 0, 0, 0, 0, 722, 667, 667, 722, 611, 556, 0, 0, 333, 0, 0, 0, 889, 722, 722, 556, 0, 667, 556, 611, 722, 0, 944, 0, 0, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 0, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [250, 0, 0, 500, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 722, 722, 0, 0, 0, 0, 0, 0, 0, 0, 944, 0, 778, 611, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 556, 444, 556, 444, 0, 500, 0, 278, 0, 556, 0, 833, 556, 500, 556, 0, 444, 389, 333, 556, 0, 0, 0, 500, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 53, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 83, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 119, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 500, 444, 278, 500, 500, 278, 0, 444, 278, 722, 500, 500, 500, 0, 389, 389, 278, 500, 0, 667]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMSY10', '/Encoding': IndirectObject(162, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(286, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 0, 0, 333, 333, 0, 0, 250, 333, 250, 278, 500, 500, 500, 500, 500, 500, 0, 0, 0, 0, 278, 0, 0, 0, 0, 0, 0, 722, 667, 667, 722, 611, 556, 0, 722, 333, 0, 0, 611, 889, 722, 722, 556, 0, 667, 556, 611, 0, 0, 0, 722, 0, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 0, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [250, 0, 0, 0, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 389, 0, 0, 0, 944, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 333, 0, 0, 278, 0, 0, 278, 833, 556, 500, 556, 0, 444, 389, 333, 556, 0, 0, 0, 500, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMSY10', '/Encoding': IndirectObject(162, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(286, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 0, 0, 0, 0, 0, 0, 333, 333, 0, 0, 0, 333, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 611, 0, 611, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 500, 444, 278, 500, 500, 278, 0, 0, 278, 0, 500, 500, 500, 0, 389, 389, 278, 0, 444, 0, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 600, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 0, 600, 0, 600, 0, 0, 600, 600, 600, 600, 0, 0, 600, 600, 600, 600, 600, 0, 0, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 500, 0, 833, 0, 0, 333, 333, 0, 0, 250, 333, 250, 0, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 0, 0, 0, 0, 0, 0, 722, 0, 667, 722, 611, 556, 722, 722, 333, 389, 722, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 722, 944, 0, 0, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 0, 611, 0, 0, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 500, 444, 278, 0, 500, 278, 0, 0, 278, 722, 500, 500, 500, 0, 389, 389, 278, 0, 444, 0, 0, 0, 389]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 45, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 600, 600, 600, 600, 0, 0, 600, 0, 0, 0, 0, 0, 600, 0, 0, 600, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 0, 600, 0, 0, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [250, 0, 0, 0, 500, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 778, 611, 0, 0, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 333, 0, 0, 278, 0, 0, 278, 833, 556, 500, 0, 0, 444, 389, 333, 556, 500, 722, 0, 500, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 778, 0, 333, 333, 0, 0, 250, 333, 250, 0, 500, 500, 500, 500, 500, 500, 0, 0, 0, 0, 278, 278, 0, 0, 0, 0, 0, 722, 667, 667, 0, 0, 556, 0, 722, 333, 0, 0, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 0, 944, 0, 0, 0, 0, 0, 0, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 250, 0, 0, 500, 0, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 722, 667, 0, 0, 0, 389, 0, 0, 0, 0, 722, 0, 611, 0, 0, 556, 667, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 333, 500, 0, 278, 0, 556, 278, 833, 556, 500, 556, 0, 444, 389, 333, 0, 500, 0, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 97, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 120, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 500, 444, 0, 0, 0, 0, 0, 0, 0, 722, 500, 0, 500, 0, 0, 389, 278, 0, 0, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 119, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 0, 0, 600, 600, 0, 600, 600, 600, 0, 600, 0, 0, 600, 600, 600, 0, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 146, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 500, 0, 0, 0, 333, 333, 0, 0, 250, 333, 250, 278, 500, 500, 500, 500, 0, 500, 500, 500, 0, 0, 278, 278, 0, 0, 0, 0, 0, 722, 667, 0, 722, 0, 556, 0, 0, 333, 0, 0, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 0, 944, 0, 0, 0, 0, 0, 0, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 0, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 65, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 119, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 0, 0, 600, 600, 0, 0, 0, 600, 0, 600, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 600, 600, 600, 600, 0, 0, 0, 600, 600, 600, 600, 0, 600, 600, 600, 0, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 118, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 250, 0, 0, 0, 500, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 389, 0, 0, 0, 0, 722, 0, 611, 0, 0, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 0, 500, 0, 278, 0, 556, 278, 833, 556, 500, 556, 0, 444, 389, 333, 556, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 97, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 119, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 500, 444, 0, 0, 0, 278, 0, 444, 0, 722, 500, 500, 500, 0, 389, 389, 0, 500, 0, 667]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 500, 500, 0, 778, 0, 333, 333, 0, 0, 250, 333, 250, 278, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 0, 0, 0, 0, 0, 0, 722, 667, 667, 722, 611, 556, 722, 722, 333, 389, 722, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 722, 944, 722, 722, 611, 0, 0, 0, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 38, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 600, 600, 600, 0, 0, 0, 600, 0, 600, 600, 600, 0, 0, 600, 0, 0, 600, 0, 600, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 0, 600, 600, 600, 600, 600, 600, 0, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMR10', '/Encoding': IndirectObject(121, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(191, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [777]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 250, 0, 0, 0, 0, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 722, 0, 611, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 333, 500, 0, 278, 0, 556, 278, 833, 556, 500, 556, 0, 444, 389, 333, 556, 0, 0, 0, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 250, 0, 0, 500, 0, 0, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 611, 0, 0, 0, 0, 0, 0, 944, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 333, 500, 556, 278, 0, 0, 278, 0, 556, 500, 556, 0, 444, 389, 333, 0, 0, 0, 0, 500, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 0, 0, 333, 333, 0, 0, 250, 333, 250, 278, 500, 500, 500, 500, 500, 500, 500, 500, 0, 500, 278, 278, 0, 0, 0, 0, 0, 722, 667, 667, 722, 0, 556, 0, 0, 333, 0, 0, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 0, 944, 0, 0, 0, 0, 0, 0, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 118, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 600, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 600, 0, 600, 600, 0, 0, 600, 600, 600, 600, 0, 0, 600, 600, 600, 0, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 97, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 116, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 500, 0, 0, 389, 278]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(201, 0, 249231333013008), '/FirstChar': 30, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 146, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 556, 0, 0, 0, 500, 0, 0, 0, 0, 333, 333, 0, 0, 250, 333, 250, 0, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 0, 0, 0, 0, 0, 0, 722, 667, 667, 722, 611, 556, 0, 722, 333, 389, 722, 611, 889, 0, 722, 556, 0, 667, 556, 611, 722, 0, 944, 0, 0, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 0, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 38, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 0, 0, 600, 0, 0, 600, 0, 600, 0, 600, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XAMVFG+NimbusMonL-Bold', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 38, '/FontDescriptor': IndirectObject(124, 0, 249231333013008), '/LastChar': 119, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 600, 600, 600, 0, 600, 600, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 600, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 600, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600, 0, 600, 600, 600, 600, 0, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 40, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 120, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [333, 333, 0, 0, 0, 333, 250, 0, 0, 0, 500, 0, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 667, 611, 0, 0, 389, 0, 0, 667, 0, 0, 0, 611, 0, 722, 556, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 0, 444, 0, 500, 0, 278, 0, 0, 278, 833, 556, 500, 556, 0, 444, 389, 333, 556, 500, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 45, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 117, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [333, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 0, 0, 556, 0, 0, 0, 611, 0, 611, 0, 556, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 500, 444, 0, 444, 0, 0, 500, 278, 0, 444, 278, 0, 0, 500, 500, 0, 389, 389, 278, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(201, 0, 249231333013008), '/FirstChar': 30, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 556, 0, 0, 0, 0, 0, 833, 0, 0, 333, 333, 0, 0, 250, 333, 250, 278, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 278, 0, 0, 0, 0, 0, 722, 0, 667, 0, 611, 556, 0, 722, 333, 0, 722, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 0, 944, 722, 0, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 0, 500, 278, 778, 500, 500, 500, 0, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 0, 0, 0, 600, 600, 0, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 600, 600, 0, 600, 0, 600, 600, 600, 600, 600, 600, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 45, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 118, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [333, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 0, 444, 0, 500, 500, 278, 0, 444, 0, 0, 500, 500, 500, 0, 389, 389, 278, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [250, 0, 0, 500, 500, 0, 0, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 667, 0, 0, 0, 0, 0, 0, 667, 944, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 556, 444, 556, 444, 0, 500, 0, 278, 0, 556, 278, 833, 556, 500, 556, 0, 444, 389, 333, 556, 0, 722, 500, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 833, 0, 0, 333, 333, 0, 0, 250, 333, 250, 0, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 0, 0, 0, 0, 0, 0, 722, 667, 667, 722, 611, 556, 722, 722, 333, 0, 722, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 0, 944, 722, 0, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 0, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 119, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 600, 0, 0, 0, 0, 600, 0, 600, 0, 0, 0, 600, 0, 0, 600, 0, 600, 0, 600, 600, 0, 600, 0, 0, 600, 0, 0, 0, 0, 0, 0, 600, 0, 600, 0, 600, 600, 600, 0, 0, 600, 600, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 600, 600, 600, 0, 600, 600, 600, 0, 600, 600, 0, 600, 600, 600, 0, 600, 600, 600, 0, 0, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 250, 0, 0, 0, 0, 500, 0, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 389, 0, 0, 0, 944, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 333, 500, 0, 278, 0, 0, 278, 833, 556, 500, 556, 0, 444, 389, 333, 0, 0, 0, 0, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMSY10', '/Encoding': IndirectObject(162, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(286, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 0, 500, 444, 0, 500, 0, 278, 0, 0, 278, 0, 500, 500, 0, 0, 389, 0, 278, 0, 0, 667, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(201, 0, 249231333013008), '/FirstChar': 30, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 146, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 556, 0, 0, 0, 0, 500, 833, 778, 0, 333, 333, 0, 0, 250, 333, 250, 0, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 278, 0, 0, 0, 0, 0, 722, 667, 667, 722, 611, 556, 0, 0, 333, 0, 722, 611, 0, 0, 0, 556, 0, 667, 556, 611, 722, 722, 944, 0, 0, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 65, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [611, 0, 667, 0, 0, 611, 0, 0, 0, 0, 667, 556, 0, 667, 0, 611, 0, 611, 500, 556, 0, 611, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 500, 444, 278, 500, 500, 278, 0, 0, 278, 722, 500, 500, 0, 0, 389, 389, 278, 500, 444, 667, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMSY10', '/Encoding': IndirectObject(128, 0, 249231333013008), '/FirstChar': 30, '/FontDescriptor': IndirectObject(286, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [277, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [250, 0, 0, 0, 0, 0, 500, 500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 944, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 556, 444, 556, 444, 333, 0, 0, 278, 0, 556, 278, 0, 556, 500, 0, 0, 444, 389, 333, 556, 500, 722, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 54, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 116, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 600, 0, 600, 0, 0, 600, 0, 600, 0, 0, 0, 0, 600, 0, 600, 0, 0, 600, 600, 0, 0, 600, 600, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 600, 600, 0, 600, 0, 600, 0, 0, 600, 600, 600, 600, 0, 0, 600, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMR10', '/Encoding': IndirectObject(129, 0, 249231333013008), '/FirstChar': 28, '/FontDescriptor': IndirectObject(191, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [388, 777, 388, 777]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 120, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [250, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 611, 0, 667, 0, 0, 611, 0, 0, 0, 0, 0, 556, 0, 0, 0, 611, 0, 611, 500, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 500, 444, 500, 444, 0, 500, 0, 278, 0, 444, 278, 0, 500, 500, 500, 0, 389, 389, 278, 500, 444, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMR10', '/Encoding': IndirectObject(131, 0, 249231333013008), '/FirstChar': 30, '/FontDescriptor': IndirectObject(191, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [777, 777]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+CMSY10', '/Encoding': IndirectObject(132, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(286, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [277]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+CMEX10', '/Encoding': IndirectObject(133, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(134, 0, 249231333013008), '/LastChar': 31, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [1000]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 500, 833, 0, 0, 333, 333, 0, 0, 250, 333, 250, 278, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 0, 0, 0, 0, 0, 0, 722, 0, 667, 722, 611, 556, 0, 722, 333, 0, 722, 0, 889, 722, 722, 556, 0, 667, 556, 611, 0, 0, 944, 0, 0, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 54, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 117, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 611, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 0, 500, 556, 278, 0, 556, 278, 833, 556, 500, 0, 0, 444, 389, 333, 556]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 50, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 83, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 600, 600, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(201, 0, 249231333013008), '/FirstChar': 30, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 148, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 333, 333, 0, 0, 250, 333, 250, 0, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 0, 0, 0, 0, 0, 0, 722, 0, 667, 722, 611, 556, 0, 722, 333, 389, 0, 611, 889, 722, 722, 556, 0, 667, 556, 611, 0, 0, 944, 722, 722, 0, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 500, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 722, 0, 0, 0, 0, 0, 389, 0, 0, 0, 0, 0, 0, 611, 0, 722, 0, 667, 0, 0, 1000, 0, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 556, 444, 333, 500, 556, 278, 0, 556, 278, 833, 556, 500, 556, 0, 444, 389, 333, 556, 500, 722, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 46, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 116, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 600, 0, 0, 600, 0, 0, 600, 600, 600, 600, 0, 0, 600, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 150, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 0, 0, 0, 0, 0, 0, 778, 0, 333, 333, 0, 0, 250, 333, 250, 0, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 0, 0, 0, 0, 0, 0, 722, 667, 667, 722, 611, 556, 722, 722, 333, 389, 722, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 722, 944, 722, 722, 611, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 0, 0, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 45, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 120, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 600, 600, 600, 600, 600, 600, 0, 600, 0, 600, 0, 0, 600, 0, 0, 0, 0, 0, 0, 600, 600, 0, 600, 0, 0, 600, 0, 0, 0, 0, 0, 0, 600, 0, 600, 0, 600, 600, 600, 0, 0, 0, 600, 0, 600, 0, 0, 0, 0, 0, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 600, 0, 600, 600, 600, 600, 600, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Medi', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 69, '/FontDescriptor': IndirectObject(280, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [667, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 444, 556, 444, 333, 0, 0, 278, 0, 0, 0, 0, 556, 0, 0, 0, 444, 389, 0, 556, 500, 0, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 40, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [333, 333, 0, 0, 250, 0, 250, 0, 500, 500, 500, 0, 500, 0, 0, 500, 500, 0, 0, 0, 0, 0, 0, 0, 0, 611, 0, 667, 0, 611, 611, 722, 0, 333, 0, 0, 556, 833, 667, 722, 611, 0, 611, 500, 556, 722, 0, 833, 611, 0, 0, 0, 0, 0, 0, 0, 0, 500, 0, 444, 500, 444, 278, 500, 500, 278, 0, 0, 278, 722, 500, 500, 500, 0, 389, 389, 278, 500, 444, 667, 0, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-Regu', '/Encoding': IndirectObject(155, 0, 249231333013008), '/FirstChar': 30, '/FontDescriptor': IndirectObject(283, 0, 249231333013008), '/LastChar': 150, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 333, 333, 0, 0, 250, 333, 250, 278, 500, 500, 500, 500, 500, 500, 500, 500, 500, 500, 278, 0, 0, 0, 0, 444, 0, 722, 667, 667, 722, 611, 556, 722, 722, 333, 389, 722, 611, 889, 722, 722, 556, 0, 667, 556, 611, 722, 722, 944, 722, 722, 611, 333, 0, 333, 0, 0, 0, 444, 500, 444, 500, 444, 333, 500, 500, 278, 278, 500, 278, 778, 500, 500, 500, 500, 333, 389, 278, 500, 500, 722, 500, 500, 444, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 0, 0, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/XWRVFG+NimbusRomNo9L-ReguItal', '/Encoding': IndirectObject(282, 0, 249231333013008), '/FirstChar': 31, '/FontDescriptor': IndirectObject(288, 0, 249231333013008), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [500, 0, 0, 0, 500, 0, 0, 778, 0, 0, 0, 0, 0, 250, 333, 250, 278, 500, 500, 500, 500, 500, 0, 500, 0, 500, 500, 0, 333, 0, 0, 0, 0, 0, 611, 0, 667, 722, 611, 611, 722, 722, 333, 0, 667, 556, 833, 667, 0, 611, 0, 611, 500, 556, 722, 611, 833, 611, 0, 0, 0, 0, 0, 0, 0, 0, 500, 500, 444, 500, 444, 278, 500, 500, 278, 0, 444, 278, 722, 500, 500, 500, 0, 389, 389, 278, 500, 444, 667, 444, 444]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/WOHPRI+NimbusMonL-Regu', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 38, '/FontDescriptor': IndirectObject(290, 0, 249231333013008), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [600, 0, 0, 0, 0, 0, 0, 600, 600, 600, 600, 600, 600, 600, 0, 600, 600, 600, 600, 0, 600, 0, 0, 600, 0, 600, 0, 0, 0, 0, 600, 600, 0, 0, 600, 0, 0, 0, 0, 600, 0, 0, 0, 0, 600, 600, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 600, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600, 0, 600, 600, 600, 600, 600, 600, 0, 600, 600, 600, 600, 600, 600, 600, 600, 600]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
OK   pypdf          2014/USENIX/understanding-the-dark-side  | use table: 24M / 100K / 1.2M (5%)
       "Overall, we made about 24M visits to over 100K parked domains. From all those visits, we identified 1.2M (5%) monetization chains including redirections"
OK   paper.cols.txt 2014/USENIX/understanding-the-dark-side  | use table: 0.8%
       "have at least 0.8% of its revenue come from illicit monetizations"
OK   paper.cols.txt WEAK 2014/USENIX/understanding-the-dark-side  | use table: 40.3%
       "40.3% for PS5"
OK   paper.cols.txt 2018/WWW/panning-for-gold-com  | use table + expiry: 1,059,050 / 80 days
       "Of the 1,059,050 domains caught during the 80-day period"
OK   paper.cols.txt 2018/WWW/panning-for-gold-com  | use table: <11%
       "less than 11% were used to host web content with the remaining domains used either by speculators, or by malicious actors"
OK   paper.cols.txt 2018/WWW/panning-for-gold-com  | expiry: 10% caught
       "only 10% of the expired (dropped) domains are caught"
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/LastChar': 3, '/BaseFont': '/LDGOFA+CMEX10', '/Type': '/Font', '/Subtype': '/Type1', '/Encoding': IndirectObject(298, 0, 279263821628688), '/Widths': [1444, 1055], '/FontDescriptor': IndirectObject(299, 0, 279263821628688), '/FirstChar': 2}, but is not installed. Consider installing fontTools if you encounter encoding problems.
OK   pypdf          2015/IEEE-SP/every-second-counts  | use table: 11.1K / 33 / 9
       "Among all 11.1K adversarial domains seen in the dataset, 33 were listed on VirusTotal (with 3 or more detections) and 9 on Google Safe Browsing"
OK   paper.cols.txt 2016/IEEE-SP/domain-z  | expiry: 27,758 / 238,279
       "we identified 27,758 domains from public blacklists and 238,279 domains resolved by malware that expired and then were maliciously re-registered"
OK   paper.cols.txt 2019/NDSS/cracking-the-wall  | expiry: 350K (56.46%)
       "350K domains (56.46%) of all the taken-down domains in the past six years have been released"
OK   paper.cols.txt 2019/NDSS/cracking-the-wall  | expiry: ~30K
       "expired sinkholes have caused the transfer of around 30K takendown domains whose traffic is now under the control of new owners"
OK   pypdf          2023/IMC/stale-tls-certificates  | expiry: stale certs quote
       "over 9 million instances of abusable third-party stale certificates from 2016-2023 across 4.5 million effective second-level domains"
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/CYOXAX+Helvetica', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 32, '/FontDescriptor': IndirectObject(369, 0, 279707614262800), '/LastChar': 116, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [278, 0, 0, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 278, 278, 556, 556, 556, 0, 556, 556, 556, 556, 556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 722, 0, 0, 0, 0, 0, 667, 667, 0, 0, 0, 0, 0, 0, 0, 556, 0, 0, 0, 556, 278, 0, 556, 222, 0, 0, 0, 833, 556, 556, 556, 0, 333, 500, 278]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/CYOXAX+Helvetica', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 32, '/FontDescriptor': IndirectObject(369, 0, 279707614262800), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [278, 0, 0, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 556, 556, 0, 0, 0, 556, 556, 556, 556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 0, 0, 556, 0, 722, 0, 0, 778, 0, 0, 611, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 556, 556, 500, 556, 556, 278, 556, 0, 222, 0, 500, 222, 833, 556, 556, 0, 0, 333, 500, 278, 556, 0, 722, 0, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/CYOXAX+Helvetica', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 32, '/FontDescriptor': IndirectObject(369, 0, 279707614262800), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [278, 0, 0, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 278, 0, 556, 556, 556, 556, 556, 556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 0, 778, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 556, 556, 500, 0, 556, 278, 556, 0, 222, 0, 0, 0, 833, 556, 556, 0, 0, 333, 500, 278, 556, 0, 0, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/CYOXAX+Helvetica', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 32, '/FontDescriptor': IndirectObject(369, 0, 279707614262800), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [278, 0, 0, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 556, 556, 556, 556, 556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 722, 722, 0, 0, 0, 722, 0, 0, 0, 0, 0, 722, 0, 0, 0, 0, 667, 611, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 556, 556, 0, 0, 556, 278, 556, 0, 222, 0, 0, 0, 833, 556, 556, 556, 556, 0, 500, 278, 556, 0, 0, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/CYOXAX+Helvetica', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 32, '/FontDescriptor': IndirectObject(369, 0, 279707614262800), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [278, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 278, 0, 556, 556, 556, 556, 556, 556, 556, 556, 556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 667, 778, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 556, 0, 0, 556, 278, 0, 0, 0, 0, 0, 0, 833, 0, 556, 0, 0, 333, 0, 278, 556, 0, 0, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/CYOXAX+Helvetica', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 32, '/FontDescriptor': IndirectObject(369, 0, 279707614262800), '/LastChar': 121, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [278, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 278, 0, 556, 556, 556, 556, 556, 556, 556, 556, 556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 722, 0, 667, 778, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 556, 0, 0, 556, 278, 0, 0, 0, 0, 0, 0, 833, 0, 556, 0, 0, 333, 0, 278, 556, 0, 0, 0, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
fontTools is required to fully parse the encoding of a CFF Type1 font in font dictionary {'/BaseFont': '/CYOXAX+Helvetica', '/Encoding': '/WinAnsiEncoding', '/FirstChar': 32, '/FontDescriptor': IndirectObject(369, 0, 279707614262800), '/LastChar': 122, '/Subtype': '/Type1', '/Type': '/Font', '/Widths': [278, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 333, 278, 0, 556, 556, 0, 0, 556, 556, 556, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 667, 0, 0, 0, 0, 0, 0, 0, 0, 722, 778, 0, 778, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 556, 556, 500, 0, 556, 278, 556, 556, 222, 0, 500, 222, 833, 556, 556, 0, 0, 333, 500, 278, 556, 500, 722, 500, 500, 500]}, but is not installed. Consider installing fontTools if you encounter encoding problems.
OK   pypdf          2023/IMC/dial-n-for-nxdomain  | residual: NXDomains
       "we identify 146,363,745,785 NXDomains queried by DNS users between 2014 and 2022"
OK   paper.cols.txt 2023/IMC/dial-n-for-nxdomain  | residual/ethics: 19
       "In total, we select 19 NXDomains for our study"
OK   paper.cols.txt 2023/IMC/dial-n-for-nxdomain  | ethics: 5,925,311 / 6 months
       "collect 5,925,311 incoming queries for 6 months"
OK   pypdf          2023/IMC/dial-n-for-nxdomain  | ethics: PII deleted
       "all data containing PIIs has been permanently deleted prior to the publication of this paper"
OK   paper.cols.txt 2023/IMC/dial-n-for-nxdomain  | ethics: keep renewing
       "we will continue monitoring and renew all 19 domains"
OK   paper.cols.txt 2016/IEEE-SP/mitm-attack-by-name-collision  | residual: 65.7%
       "65.7% (485) of them exhibited leaked WPAD queries to the 2 DNS root servers in our dataset before their delegation"
OK   paper.cols.txt 2016/IEEE-SP/mitm-attack-by-name-collision  | residual: by August 2015
       "We study the 738 new gTLDs that have already been delegated before 2015/08/25"
OK   paper.cols.txt 2024/WWW/hyperlink-hijacking  | residual: 572,000 phantom
       "more than 572 000 dot-com domains that have never been registered"
OK   paper.cols.txt 2024/WWW/hyperlink-hijacking  | ethics: blank page, 51 registered
       "identified, registered and connected to a hosting account serving a zero-length (i.e. blank) landing page"
OK   paper.cols.txt 2024/WWW/hyperlink-hijacking  | ethics: 3 x 17 = 51
       "The 3 phantom domains with the highest PageRank from each of the 17 error categories were purchased"
OK   paper.cols.txt 2024/WWW/hyperlink-hijacking  | ethics: approval
       "complete with ethics approval"
OK   paper.cols.txt 2024/WWW/hyperlink-hijacking  | ethics: no tracking JS
       "we chose to take a less intrusive path"
OK   paper.cols.txt 2025/USENIX/lost-in-the-mists  | residual: 309 / 149 / 41
       "We discovered that 309 versions of 149 unique apps relied on 41 first-order domains that were immediately registrable"
OK   paper.cols.txt 2025/USENIX/lost-in-the-mists  | ethics: refusal
       "We did not register any expired domains"
OK   paper.cols.txt 2026/PETS/dead-domains-living-data  | residual: 3,420
       "track the lifecycle of 3,420 associated domains"
OK   paper.cols.txt 2026/PETS/dead-domains-living-data  | residual: 11,131
       "dynamic analysis of 11,131 apps"
OK   paper.cols.txt 2026/PETS/dead-domains-living-data  | residual: 218
       "we identify 218 domains with dangling CNAMEs susceptible to subdomain hijacking"
OK   paper.cols.txt 2026/PETS/dead-domains-living-data  | ethics/dangling: refusal
       "We did not re-register expired domains, claim dangling cloud resources, or exploit any of the endpoints"
OK   paper.cols.txt 2020/IMC/trufflehunter  | residual: typosquats among the case studies
       "typo-squatting domains"
OK   paper.cols.txt 2021/USENIX/can-i-take-your-subdomain  | dangling: 1,520 / 887
       "RDScan identified 1,520 subdomains exposed to a takeover vulnerability, distributed among 887 domains from the top 50k of the Tranco list"
OK   paper.cols.txt 2021/USENIX/can-i-take-your-subdomain  | dangling: 83 / 17
       "Most of the vulnerabilities are caused by discontinued third-party services (83%), with expired domains being responsible for the remaining 17%"
OK   paper.cols.txt 2021/USENIX/can-i-take-your-subdomain  | dangling: 13,532
       "The analysis of deprovisioned cloud instances discovered 13,532 potentially vulnerable domains"
OK   paper.cols.txt 2021/USENIX/can-i-take-your-subdomain  | dangling: no cloud claims (quote)
       "We did not create any virtual machine or registered any service at cloud providers in this process"
OK   pypdf          2021/USENIX/can-i-take-your-subdomain  | dangling: test accounts
       "we created personal testing accounts on each service"
OK   paper.cols.txt 2022/IEEE-SP/measuring-and-mitigating-the-risk-of-ip-reuse  | dangling: 1.5M IPs
       "we deployed over 3 million servers receiving 1.5 million unique IP addresses"
OK   paper.cols.txt 2022/IEEE-SP/measuring-and-mitigating-the-risk-of-ip-reuse  | dangling: 56% / 101 days
       "56% of the available pool) over 101 days"
OK   paper.cols.txt 2022/IEEE-SP/measuring-and-mitigating-the-risk-of-ip-reuse  | dangling: cost
       "2089.76 USD over 101 days"
OK   paper.cols.txt 2022/IEEE-SP/measuring-and-mitigating-the-risk-of-ip-reuse  | dangling: 14
       "14 topmillion domains had dangling DNS records at the SLD level"
OK   paper.cols.txt 2022/IEEE-SP/measuring-and-mitigating-the-risk-of-ip-reuse  | ethics: exemption
       "Our data collection was covered under an exemption from our institutional review board (IRB)"
OK   paper.cols.txt 2022/IEEE-SP/measuring-and-mitigating-the-risk-of-ip-reuse  | ethics: encrypted
       "All collected data was stored in an encrypted S3 bucket"
OK   paper.cols.txt 2022/IEEE-SP/measuring-and-mitigating-the-risk-of-ip-reuse  | ethics: disclosure via Amazon
       "Disclosure of all discovered vulnerability was performed through Amazon"
OK   paper.cols.txt 2024/USENIX/cross-the-zone  | dangling: 125,124
       "affecting 125,124 domains of notable enterprises"
OK   paper.cols.txt 2024/USENIX/cross-the-zone  | dangling: 10 of 12
       "most (10 of 12) of the vulnerable providers do not deploy any measures against domain name hijacking"
OK   paper.cols.txt 2024/USENIX/cross-the-zone  | ethics: <2 minutes
       "completing the entire process within 2 minutes"
OK   paper.cols.txt 2024/USENIX/cross-the-zone  | ethics: Menlo
       "guided by the principles of the Menlo Report"
OK   paper.cols.txt 2024/USENIX/rethinking-the-security-threats-of-stale-dns-glue  | dangling: 23.18%
       "We found, surprisingly, that 23.18% of glue records are stale"
OK   paper.cols.txt 2024/USENIX/rethinking-the-security-threats-of-stale-dns-glue  | dangling: 193,558 / 6,687,000
       "we identified 193,558 directly potentially exploitable glue records, impacting 6,687,000 domains"
OK   paper.cols.txt 2025/USENIX/misty-registry  | dangling: 3.4K relic
       "we identified 3.4K relic domains and 6 vulnerable registry backends"
OK   paper.cols.txt 2025/USENIX/misty-registry  | dangling: 812 TLDs
       "that supported 812 TLDs"
OK   paper.cols.txt 2023/IMC/wolf-in-sheeps-clothing  | ethics: A to localhost + TXT
       "configured an A record pointing to the localhost and a TXT record indicating our identity, intentions, and contact information"
OK   pypdf          2023/IMC/wolf-in-sheeps-clothing  | ethics: 30 domains incl. top-100
       "five domains from the top 100 Tranco sites, 20 eTLDs, and five unregistered domains"
OK   paper.cols.txt 2023/IMC/wolf-in-sheeps-clothing  | ethics: removed
       "we removed all URs that we set"
OK   paper.cols.txt 2017/IMC/email-typosquatting  | ethics: 76
       "we registered 76 typosquatting domain names"
OK   paper.cols.txt 2017/IMC/email-typosquatting  | ethics: seven months, millions
       "In the span of over seven months, we received millions of emails at our registered domains"
OK   paper.cols.txt 2017/IMC/email-typosquatting  | ethics: regex scrub
       "we automatically remove sensitive information using regular expression matching prior to storage"
OK   paper.cols.txt 2017/IMC/email-typosquatting  | ethics: encrypted
       "using an encryption key kept separately from the server"
OK   paper.cols.txt 2017/IMC/email-typosquatting  | ethics: two IRBs
       "The protocol was approved by our IRB, and our sponsor's IRB"
OK   paper.cols.txt 2024/IMC/bounce-in-the-wild  | ethics: 30 registered
       "we registered 30 domain names with the highest"
OK   paper.cols.txt 2024/IMC/bounce-in-the-wild  | ethics: nothing deployed (fragment; column splice)
       "For ethical and privacy reasons, we have"
OK   paper.cols.txt WEAK 2024/IMC/bounce-in-the-wild  | ethics: transfer free of charge
       "free of charge"
OK   paper.cols.txt 2024/IMC/bounce-in-the-wild  | ethics: partner authorisation
       "our institution lacks an Institutional Review Board (IRB), our research has been authorized and supervised by the network management department and regulatory authority of our partner"
OK   paper.cols.txt 2025/NDSS/welcome-to-jurassic-park  | ethics: Deno registered it
       "Deno team decided to register the problematic domain in response to our disclosure"
 
140 needles; located by: paper.cols.txt 125, pypdf 15; weak (<20 chars): 4; not located: 0
 
=== EXTERNAL FIGURES (non-corpus; primary sources re-fetched by external_checks_domain_abuse.sh) ===
dnstwist release 20250130, last commit 2025-04-15, 16 fuzzers; URLCrazy v0.8.2 (2025-07-28), 17 types; ail-typo-squatting v2.7.4 (2023-12-01), commits to 2025-04-30; twistrs pushed 2026-09-25
UTS #39 confusables Version 18.0.0; Chromium idn.md skeleton rule
Verisign zone files omit serverHold/clientHold/pendingDelete/redemptionPeriod; .com/.net/.name via CZDS
WHOIS sunset 28 January 2025; Registration Data Policy 21 August 2025; RDRS launched November 2023, extended November 2025 for up to two years
NIS2 Art. 28(4), transposition 17 October 2024; ICANN DNS Abuse definition effective 5 April 2024; WIPO over 6,200 cases in 2025
ERRP: auto-renew grace 1-45 days, RGP 30 days; pending delete five days
WhoisXML ~450,000 NRD/day; nuclei http/takeovers 73 templates, touched 2026-07-20; can-i-take-over-xyz pushed 2025-02-08; dnsReaper 2.0.3 (2025-10-06); subjack v3.0.0 (2026-03-16)
Microsoft Learn subdomain-takeover page dated 2026-07-20; DomainLynx arXiv:2410.02095 (IEEE CCNC 2025), extended version IEEE Access doi:10.1109/ACCESS.2025.3542036; nuclei takeover templates last touched by a re-signing commit
LLM classification corpus-wide: 2 of 719 (2023), 77 of 770 (2025) — from report_domain_abuse.mjs PASS I
=== NOT FIGURES (identifiers that cannot go stale; listed so check_page_numbers.mjs passes without the shared ALLOW map) ===
doi:10.1007/978-3-319-13257-0_17 (Soundsquatting, ISC 2014); doi:10.1109/ACCESS.2025.3542036 (DomainLynx); Directive (EU) 2022/2555, CELEX 32022L2555
Registration Data Policy §9.2.1 and §§9.2.2.1–9.2.2.2; .com RA Appendix 7 §3.3.2; 2024 RA amendment Specification 6 §4.1; 127.0.0.1 (loopback address in a paper's ethics safeguard)
Strider Typo-Patrol, SRUTI 2006; UTS #39 confusables version 18.0.0
=== TEMPLATE LITERALS (illustrative sentence, not data) ===
"We found 40,000 typosquatting domains"

external_checks_domain_abuse-output.txt

== 1. Registration data: WHOIS sunset, RDAP, Registration Data Policy, RDRS ==
OK   [200] ICANN: RDAP definitive, WHOIS sunset 28 Jan 2025 — "As of 28 January 2025, the Registration Data Access Protocol (RDAP) will be the definitive source"
OK   [200] ICANN: WHOIS services sunsetted — "in place of sunsetted WHOIS services"
OK   [200] ICANN: Registration Data Policy in effect 21 Aug 2025 — "today marks the effective date of the Registration Data Policy"
OK   [200] ICANN: RDRS intended requesters (RDAP announcement) — "like law enforcement, intellectual property professionals, consumer protection advocates, cybersecurity professionals, and government officials"
OK   [200] ICANN: RDRS extended after pilot — "for up to two years past the project's initial pilot period"
OK   NIS2 Art. 28(4): publish non-personal registration data
OK   NIS2 Art. 41: transposition by 17 October 2024
 
== 2. What ICANN calls DNS abuse, and what it does not ==
OK   [200] 2024 RA amendment: DNS Abuse definition — ""DNS Abuse" is defined as malware, botnets, phishing, pharming, and spam (when spam serves as a delivery mechanism for the other forms of DNS Abuse"
OK   [200] WIPO: record UDRP caseload 2025 — "managing over 6,200 domain name cases"
 
== 3. Expiry lifecycle ==
OK   [200] ICANN ERRP: 30-day RGP — "Redemption Grace Period"
OK   [200] ICANN ERRP: auto-renew grace 1-45 days — "1-45-day"
OK   [200] .com RA Appendix 7: pending delete five days — "The current length of this Pending Delete Period is five calendar days"
 
== 4. Zone data ==
OK   [200] Verisign: .com/.net zone files via CZDS — "To request access to the zone files for the .com , .net , and .name TLDs and other Verisign-operated generic TLDs, use ICANN's Centralized Zone Data Service (CZDS)"
OK   [200] Verisign: zone files omit hold / pendingDelete / redemption names — "The TLD zone files do not contain domain names in the following states: serverHold, clientHold, pendingDelete, and redemptionPeriod"
OK   [200] ICANN CZDS: any interested party may request — "The Centralized Zone Data Service provides a centralized point for interested parties to request access to Zone Files"
OK   [200] .se/.nu zone data open, hourly — "The zone files are updated every hour"
OK   [200] .ee zone file downloadable by AXFR — "downloadable based on the AXFR protocol"
OK   [200] ICANN: 2026 round application window — "30 April through 12 August 2026"
 
== 5. Data access ==
OK   [200] OpenINTEL open data licence — "CC BY-NC-SA 4.0"
OK   [200] Farsight grant programme (DNSDB, NOD) — "engaged in academic research"
 
== 6. Candidate generators ==
OK   dnstwist repo: archived=False pushed=2025-04-15T18:41:47Z license=Apache-2.0
OK   dnstwist latest release: 20250130 2025-01-30T19:47:15Z
OK   dnstwist.py fuzzer labels checked (16)
OK   dnstwist.py: WHOIS class, ssdeep, tlsh, pHash present
OK   URLCrazy repo: archived=False pushed=2025-07-28T07:24:43Z
OK   URLCrazy latest release: v0.8.2 2025-07-28T07:24:43Z
OK   [200] URLCrazy: 17 variant types — "Generates 17 types of domain variants"
OK   [200] URLCrazy: bespoke licence — "You do not have permission to distribute modified versions without permission"
OK   [200] URLCrazy: no WHOIS checking — "This tool does not check if a domain has been registered"
OK   ail-typo-squatting repo: archived=False pushed=2025-04-30T08:47:29Z
OK   ail-typo-squatting latest release: v2.7.4 2023-12-01T08:07:26Z
OK   JuxhinDB/twistrs answers 301 (moved)
OK   twistrs repo (moved): archived=False pushed=2026-09-25T00:36:43Z
OK   [200] UTS #39 confusables.txt version — "Version: 18.0.0"
OK   Chromium idn.md: skeleton check against top domains
 
== 7. Takeover tooling ==
OK   can-i-take-over-xyz: archived=False pushed=2025-02-08T01:51:50Z
OK   dnsReaper latest release: 2.0.3 2025-10-06T10:58:46Z
OK   subjack latest release: v3.0.0 2026-03-16T05:55:51Z
OK   nuclei-templates last commit touching http/takeovers: 2026-07-20T05:01:36Z chore: sign templates 🤖
OK   nuclei-templates http/takeovers parked-domain templates: godaddy-parked-domain.yaml
OK   nuclei-templates http/takeovers file count: 73
OK   [200] Microsoft Learn: dangling DNS definition — "Such DNS records are also known as "dangling DNS" entries"
 
== 8. Outside-corpus literature ==
OK   Crossref 10.1109/ACCESS.2025.3542036: DomainLynx: Advancing LLM Techniques for Robust Domain Squatting Detection | IEEE Access
OK   [200] DomainLynx (arXiv 2410.02095) abstract — "leveraging Large Language Models (LLMs) for enhanced domain squatting detection"
OK   Crossref 10.1145/3646547.3689021: DarkDNS: Revisiting the Value of Rapid Zone Update | Proceedings of the 2024 ACM on Internet Measurement Conference
 
FAILS=0

da_probes.mjs

// da_probes.mjs — candidate probes behind security:domain_abuse. Imported by
// da_fold.mjs (verdicts) and report_domain_abuse.mjs. The probes produce a
// CANDIDATE set; the population is the hand verdict in da_fold.mjs.
 
// The 2026-09-22 gap pass's regex, unchanged (gap_probe_fulltext_20260922.mjs, family "domain_abuse").
export const GAP_RE = /typosquat|combosquat|bitsquat|soundsquat|dropcatch|drop-catch|expired domain|residual trust|parked domain|domain parking|dangling (DNS|record|CNAME)|subdomain takeover|homograph/gi;
// Look-alike names: every squatting model and its synonyms (the gap regex has no "cybersquat", "lookalike", "homoglyph", "IDN", "doppelganger").
export const SQUAT_RE = /typo-?squat|combo-?squat|bit-?squat|sound-?squat|cyber-?squat|domain[- ]squat|brand-?squat|level-?squat|doppelg(a|ä)nger domain|look-?alike domains?|homoglyph|homograph(?!y)|confusable|IDN (homograph|spoof|abuse|attack)|punycode|typo(-| )domains?|misspelled domain/gi;
// Lifecycle and delegation: expiry, drop, re-registration, residual trust, dangling records, takeover, lame delegation.
// "dangling" is only counted next to a DNS object, because a bare "dangling" is a use-after-free pointer in this corpus.
export const LIFE_RE = /expired domains?|domain(s|-name|name)? expir|expir(ed|ing|ation) of (the |a )?domains?|re-?regist(ered|ration|ering) (of )?(the |a |expired |deleted )?domains?|domains? (were |was |are |is |being )?re-?regist|drop-?catch|drop catch|residual trust|deleted domains?|lapsed domains?|domain drop|dangling (DNS|record|resource|CNAME|NS|domain|delegation|A record|IP|pointer to (a |an )?(domain|IP|resource))|subdomain takeover|domain takeover|takeover of (the |a )?(sub)?domain|hijack(ed|ing)? (sub)?domains?|(sub)?domain hijack|lame delegation|sacrificial (name ?server|NS)|stale (DNS|record|glue|certificate|NS)|abandoned (domain|resource|bucket|cloud)|IP (address )?reuse|phantom domain|orphan(ed)? (DNS|domain|name ?server|record)|name collisions?/gi;
// Parking and monetisation.
export const PARK_RE = /parked (domain|page|site)s?|domain parking|parking (page|service|provider|program|compan)|domain monetization|monetiz(e|ing|ation of) (parked )?domains/gi;
// Registration data as the instrument: zone files, CZDS, NRD feeds, WHOIS, RDAP, registrars. High threshold: a paper ABOUT the registration system, not one that used a zone file.
export const REG_RE = /zone files?|CZDS|newly[- ]registered domains?|\bNRDs?\b|domain registration|registrar|RDAP|WHOIS/gi;
// The extraction's own free-text fields (detection phenomenon/technique, classification resourceName/targetDetail, population sourceList). Topic words only: zone files as a source are counted separately (da_sources in the report).
export const SCHEMA_RE = /squat|parked|domain parking|parking (page|service|domain)|expired domain|domain(-name| name)? expir|drop-?catch|dangling (DNS|record|CNAME|domain|resource|cloud|sinkhole|IP|related)|subdomain takeover|domain takeover|domain hijack|hijack(ed|ing)? (sub)?domain|homograph(?!y)|homoglyph|\bIDNs?\b|punycode|domain re-?regist|re-?regist\w* (of )?(expired |deleted )?domain|residual trust|lame delegation|look-?alike domain|typo-?(squat|domain)|domain impersonat/i;
export const THRESH = { GAP: 5, SQUAT: 5, LIFE: 5, PARK: 5, REG: 30 };
// Title sweep over the 16,864-record venue index (corpus2/.meta), to find papers that never reached the extraction.
export const TITLE_RE = /squat|parked|parking|expir|drop-?catch|re-?registration|residual trust|dangling|takeover|hijack|homograph|homoglyph|\bIDNs?\b|internationali[sz]ed domain|WHOIS|RDAP|registrar|zone file|lame delegation|domain name/i;

da_fold.mjs

// da_fold.mjs — inclusion rule, codes and hand verdicts behind security:domain_abuse
// ("Domain abuse: squatting, parking, expired domains and dangling DNS"). Imported by
// report_domain_abuse.mjs; nothing here is computed, it is the audit surface.
//
// The probes (da_probes.mjs) produce a CANDIDATE set. The population is the hand
// verdict below; report_domain_abuse.mjs throws if a candidate has no verdict or a
// verdict names a paper that is not a candidate.
 
export const INCLUSION_RULE = `INCLUSION RULE (written 2026-09-25, before the verdicts were counted):
IN      — the paper's measured objects include DNS names (registered domains, subdomains, or the
          records and delegations behind them) whose abuse comes from the NAME or its LIFECYCLE,
          and the paper counts instances in the wild (generates or collects candidates and
          resolves, crawls, registers, classifies or detects them). Four families:
            lookalike — typo/combo/bit/sound/homograph squatting of a live name, user-error names
                        (unintended URLs, email typos), defensive registration and disputes about it;
            parking   — parked domains, parking monetisation, and what registrations are used for;
            residual  — names that keep receiving trust or traffic they were not meant to: expired,
                        dropped and re-registered names, taken-down names released again,
                        referenced-but-unregistered names (NXDOMAIN traffic, name collisions,
                        phantom links, expired dependencies of apps and code);
            dangling  — records and delegations that point at something the owner no longer
                        controls: dangling CNAME/A records and subdomain takeover, lame and
                        orphaned delegations, stale NS and glue, released cloud IPs, DNS-hosting
                        zones created by someone else.
          scope P = the paper's subject; S = one measured section of a paper about something else
          (the section must report an in-the-wild count, not only mention the risk).
CONTEXT — adjacent, cited as a pointer, not counted: squatting or lifecycle abuse in a namespace
          that is not DNS (packages, container images, apps, voice skills, social handles,
          blockchain names, wallet addresses); a lookalike name only as the vehicle of phishing,
          scams or fraud, which is the object (security:phishing, security:online_scams); the
          registration system itself as instrument or object (WHOIS/RDAP, zone files, registrars);
          malicious-domain detection, DGA, takedown and sinkholing; hijacking through resolver or
          registrar attacks (design:dns); search poisoning on misspellings; user studies of
          lookalike URLs; a takeover/expiry check inside a broader audit with no in-the-wild count.
OUT     — homonyms ("dangling" pointers, "homography", "re-register" an account), or the terms
          occur only in related work, as a data source, or in passing.
Decisions recorded with the rule: email typosquatting is IN (the object is a registered DNS name;
only the protocol delivering the mistaken traffic differs). Container-registry and package
typosquatting are CONTEXT (a different registry with its own namespace rules). ENS/blockchain
names are CONTEXT for the same reason, although ENS dropcatching reuses the dropcatching design.`;
 
export const IN_TYPES = {
  lookalike: 'typo/combo/bit/homograph squatting, user-error names, defensive registration, disputes',
  parking: 'parked domains, parking monetisation, what registrations are used for',
  residual: 'expired / dropped / re-registered / released / referenced-but-unregistered names',
  dangling: 'dangling records, subdomain takeover, lame/orphaned delegation, stale NS/glue, released cloud IPs, hosting zones',
};
export const CONTEXT_CODES = {
  'other-namespace': 'squatting or lifecycle abuse in a non-DNS namespace (packages, containers, apps, skills, handles, blockchain names, addresses)',
  uses: 'a lookalike or re-registered name is only the vehicle; the phishing / scam / fraud it carries is the object',
  'registration-data': 'WHOIS/RDAP, zone files, registrar or registry operation as the instrument or object',
  'malicious-domains': 'malicious-domain detection, DGA, registration-time detection, takedown, sinkholing',
  'dns-attack': 'hijacking via resolver, cache or registrar-account attacks; resolver behaviour (design:dns)',
  'search-abuse': 'search poisoning on misspellings, wildcard-DNS spam',
  'user-study': 'people judging lookalike URLs',
  'mention-check': 'a takeover / expiry check inside a broader audit, no in-the-wild count',
};
export const OUT_CODES = {
  homonym: '"dangling" pointer, "homography", account "re-registration", "registrar" in another sense',
  mention: 'terms only in related work, a data source, a cleaning step, or in passing',
};
 
// [key, verdict, code, scope (IN only: 'P' primary | 'S' section), note]
export const VERDICTS = [
  ['IMC/2010/an-empirical-study-of-orphan-dns-servers-in-the-internet', 'IN', 'dangling', 'P', 'orphan NS/glue records left in TLD zones after the parent domain is deleted; abuse by malicious domains'],
  ['IMC/2010/detecting-algorithmically-generated-malicious-domain-names', 'CONTEXT', 'malicious-domains', null, 'DGA / domain-fluxing detection'],
  ['CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web', 'OUT', 'mention', null, 'trending-term search abuse; typosquatting in passing'],
  ['CCS/2011/ispy-automatic-reconstruction-of-typed-input-from-compromising-reflections', 'OUT', 'homonym', null, 'homography (computer vision)'],
  ['CCS/2011/waptec-whitebox-analysis-of-web-applications-for-parameter-tampering-exploit-con', 'OUT', 'homonym', null, 'web-app parameter tampering; schema hit is not a DNS name'],
  ['IEEE-SP/2011/click-trajectories-end-to-end-analysis-of-the-spam-value-chain', 'OUT', 'mention', null, 'registrars as one stage of the spam value chain (security:online_scams)'],
  ['USENIX/2011/secure-in-band-wireless-pairing', 'OUT', 'homonym', null, 'wireless pairing; registration-probe false positive'],
  ['NDSS/2012/ghost-domain-names-revoked-yet-still-resolvable', 'CONTEXT', 'dns-attack', null, 'revoked domains kept alive by resolver caches — resolver behaviour'],
  ['USENIX/2012/sting-finding-name-resolution-vulnerabilities-in-programs', 'OUT', 'homonym', null, 'filesystem name resolution; "squatting" on files'],
  ['CCS/2013/viceroi-catching-click-spam-in-search-ad-networks', 'OUT', 'mention', null, 'click-spam; parked-domain publishers in passing'],
  ['IEEE-SP/2013/finding-the-linchpins-of-the-dark-web-a-study-on-topologically-dedicated-hosts-o', 'OUT', 'mention', null, 'malicious hosting topology; parking compared in passing'],
  ['WWW/2013/bitsquatting-exploiting-bit-flips-for-fun-or-profit', 'IN', 'lookalike', 'P', 'bitsquatting registrations of Alexa top-500 targets, crawled 270 days'],
  ['CCS/2014/blind-recognition-of-touched-keys-on-mobile-devices', 'OUT', 'homonym', null, 'homography (computer vision)'],
  ['USENIX/2014/the-long-taile-of-typosquatting-domain-names', 'IN', 'lookalike', 'P', 'typosquatting across the .com zone and popularity levels'],
  ['USENIX/2014/understanding-the-dark-side-of-domain-parking', 'IN', 'parking', 'P', 'parking monetisation chains traced with controlled parking and traffic-buying accounts'],
  ['IEEE-SP/2015/every-second-counts-quantifying-the-negative-externalities-of-cybercrime-via-typ', 'IN', 'lookalike', 'P', 'typosquatting traffic and user time lost, passive DNS/HTTP and proxy logs'],
  ['IMC/2015/affiliate-crookies-characterizing-affiliate-marketing-abuse', 'CONTEXT', 'uses', null, 'cookie-stuffing affiliate fraud, often through typosquatted domains; the fraud is the object'],
  ['IMC/2015/from-academy-to-zone-an-analysis-of-the-new-tld-land-rush', 'IN', 'parking', 'P', 'new-gTLD registrations classified by use: parked, unused, defensive redirect, content'],
  ['IMC/2015/who-is-com-learning-to-parse-whois-records', 'CONTEXT', 'registration-data', null, 'WHOIS parsing at .com scale — the instrument'],
  ['NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains', 'IN', 'parking', 'P', 'parked-domain classifier and prevalence across 15 parking services'],
  ['NDSS/2015/seven-months-worth-of-mistakes-a-longitudinal-study-of-typosquatting-abuse', 'IN', 'lookalike', 'P', 'daily crawl of generated typo domains of Alexa top 500 for seven months'],
  ['CCS/2016/measurement-and-analysis-of-private-key-sharing-in-the-https-ecosystem', 'OUT', 'mention', null, 'TLS key sharing; WHOIS as a data source'],
  ['CCS/2016/predator-proactive-recognition-and-elimination-of-domain-abuse-at-time-of-regist', 'CONTEXT', 'malicious-domains', null, 'registration-time detection of spam domains from registry logs'],
  ['IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in', 'IN', 'residual', 'P', 'residual trust of expired domains; Alembic detector'],
  ['IEEE-SP/2016/mitm-attack-by-name-collision-cause-analysis-and-vulnerability-assessment-in-the', 'IN', 'residual', 'P', 'leaked WPAD queries for new-gTLD names that anyone can register (name collision)'],
  ['IMC/2016/tunneling-for-transparency-a-large-scale-analysis-of-end-to-end-violations-in-th', 'OUT', 'homonym', null, 'ISP NXDOMAIN "hijacking" (response rewriting)'],
  ['IMC/2016/whois-lost-in-translation-mis-understanding-domain-name-expiration-and-re-regist', 'IN', 'residual', 'P', 'expiration, deletion and re-registration timing from zone removals plus WHOIS'],
  ['USENIX/2016/a-comprehensive-measurement-study-of-domain-generating-malware', 'CONTEXT', 'malicious-domains', null, 'DGA families; registration and parking of DGA domains'],
  ['USENIX/2016/hey-you-have-a-problem-on-the-feasibility-of-large-scale-web-vulnerability-notif', 'OUT', 'mention', null, 'vulnerability notification; WHOIS contacts as a channel'],
  ['USENIX/2016/the-ever-changing-labyrinth-a-large-scale-analysis-of-wildcard-dns-powered-black', 'CONTEXT', 'search-abuse', null, 'wildcard-DNS blackhat SEO'],
  ['USENIX/2016/youve-got-vulnerability-exploring-effective-vulnerability-notifications', 'OUT', 'mention', null, 'vulnerability notification; WHOIS contacts as a channel'],
  ['WWW/2016/no-honor-among-thieves-a-large-scale-analysis-of-malicious-web-shells', 'OUT', 'mention', null, 'web shells; expired domains in passing'],
  ['CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study', 'IN', 'residual', 'P', 'service-discovery queries leaking into registrable new-gTLD names'],
  ['CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse', 'IN', 'lookalike', 'P', 'combosquatting from passive/active DNS, 2.7M domains, 268 trademarks'],
  ['IEEE-SP/2017/a-lustrum-of-malware-network-communication-evolution-and-insights', 'CONTEXT', 'malicious-domains', null, 'malware C&C domains, including expired ones'],
  ['IEEE-SP/2017/under-the-shadow-of-sunshine-understanding-and-detecting-bulletproof-hosting-on', 'OUT', 'mention', null, 'bulletproof hosting; IP WHOIS'],
  ['IMC/2017/email-typosquatting', 'IN', 'lookalike', 'P', 'registered typo domains of email providers and counted the mail they received'],
  ['IMC/2017/understanding-the-role-of-registrars-in-dnssec-deployment', 'OUT', 'mention', null, 'registrars and DNSSEC deployment'],
  ['NDSS/2017/dial-one-for-scam-a-large-scale-analysis-of-technical-support-scams', 'CONTEXT', 'uses', null, 'typosquatting domains as a malvertising seed for tech-support scams (security:online_scams)'],
  ['PETS/2017/topics-of-controversy-an-empirical-analysis-of-web-censorship-lists', 'OUT', 'mention', null, 'censorship lists; parked pages filtered as a cleaning step'],
  ['USENIX/2017/game-of-registrars-an-empirical-analysis-of-post-expiration-domain-name-takeover', 'IN', 'residual', 'P', 'post-expiration re-registration across five TLDs; dropcatch registrars'],
  ['IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri', 'IN', 'residual', 'P', '.com drop timing, dropcatch registrar clusters'],
  ['IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild', 'IN', 'lookalike', 'P', 'five squatting models over 224M DNS records; classified which squatting domains phish'],
  ['USENIX/2018/schrodinger-s-rat-profiling-the-stakeholders-in-the-remote-access-trojan-ecosyst', 'CONTEXT', 'malicious-domains', null, 'sinkholed expired RAT controller domains to count victims'],
  ['USENIX/2018/skill-squatting-attacks-on-amazon-alexa', 'CONTEXT', 'other-namespace', null, 'voice-skill squatting'],
  ['WWW/2018/betrayed-by-your-dashboard-discovering-malicious-campaigns-via-web-analytics', 'OUT', 'mention', null, 'analytics-ID campaign clustering'],
  ['WWW/2018/panning-for-gold-com-understanding-the-dynamics-of-domain-dropcatching', 'IN', 'residual', 'P', '28.4M expiring domains; dropcatch services; post-re-registration use'],
  ['CCS/2019/you-are-who-you-appear-to-be-a-longitudinal-study-of-domain-impersonation-in-tls', 'IN', 'lookalike', 'P', 'impersonating names in TLS certificates (Censys), incl. typo and homograph'],
  ['IEEE-SP/2019/dangerous-skills-understanding-and-mitigating-security-risks-of-voice-controlled', 'CONTEXT', 'other-namespace', null, 'voice squatting'],
  ['IEEE-SP/2019/measuring-and-analyzing-search-engine-poisoning-of-linguistic-collisions', 'CONTEXT', 'search-abuse', null, 'search poisoning of misspelled search terms'],
  ['IEEE-SP/2019/resident-evil-understanding-residential-ip-proxy-as-a-dark-service', 'OUT', 'mention', null, 'residential proxies; WHOIS as data source'],
  ['IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs', 'IN', 'lookalike', 'P', 'IDN homograph detection in .com; homoglyph database'],
  ['NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs', 'IN', 'residual', 'P', 'taken-down domains released or re-bought after sinkhole domains expired'],
  ['NDSS/2019/life-after-speech-recognition-fuzzing-semantic-misinterpretation-for-voice-assistant-applications', 'CONTEXT', 'other-namespace', null, 'voice-app squatting'],
  ['USENIX/2019/small-world-with-high-risks-a-study-of-security-threats-in-the-npm-ecosystem', 'OUT', 'mention', null, 'npm dependency risk; typosquatting in passing'],
  ['WWW/2019/pythia-a-framework-for-the-automated-analysis-of-web-hosting-environments', 'OUT', 'mention', null, 'hosting classification via RDAP'],
  ['CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr', 'IN', 'dangling', 'P', 'stale NS records at DNS hosting providers that let anyone claim the zone'],
  ['IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers', 'IN', 'lookalike', 'S', 'case study: estimates users of typosquatting domains by cache snooping public resolvers'],
  ['IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations', 'IN', 'dangling', 'P', 'nine years of lame delegations; registrable nameserver domains'],
  ['NDSS/2020/a-practical-approach-for-taking-down-avalanche-botnets-under-real-world-constraints', 'CONTEXT', 'malicious-domains', null, 'classifying registered DGA domains for a takedown'],
  ['NDSS/2020/complex-security-policy-a-longitudinal-analysis-of-deployed-content-security-policies', 'OUT', 'mention', null, 'CSP; typo-squatting models used to explain host-source typos'],
  ['NDSS/2020/disco-sidestepping-rpkis-deployment-barriers', 'OUT', 'mention', null, 'RPKI; registry in the RIR sense'],
  ['WWW/2020/mobile-app-squatting', 'CONTEXT', 'other-namespace', null, 'app identifier squatting'],
  ['CCS/2021/out-of-sight-out-of-mind-detecting-orphaned-web-pages-at-internet-scale', 'OUT', 'mention', null, 'orphaned web pages, not names'],
  ['IMC/2021/risky-bizness-risks-derived-from-registrar-name-management', 'IN', 'dangling', 'P', 'sacrificial nameserver renaming by registrars; hijackable delegations'],
  ['IMC/2021/the-parallel-lives-of-autonomous-systems-asn-allocations-vs-bgp', 'OUT', 'mention', null, 'ASN allocation; dormant-ASN squatting is not DNS'],
  ['NDSS/2021/from-whois-to-whowas-a-large-scale-measurement-study-of-domain-registration-privacy-under-the-gdpr', 'CONTEXT', 'registration-data', null, 'GDPR redaction of WHOIS, 1.2B records — the instrument'],
  ['NDSS/2021/hey-alexa-is-this-skill-safe-taking-a-closer-look-at-the-alexa-skill-ecosystem', 'CONTEXT', 'other-namespace', null, 'skill squatting'],
  ['NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media', 'IN', 'lookalike', 'P', 'unintended URLs in tweets; registered 45 such domains and counted the traffic'],
  ['NDSS/2021/towards-measuring-supply-chain-attacks-on-package-managers-for-interpreted-languages', 'OUT', 'mention', null, 'package supply chain; typosquatting as one attack vector named'],
  ['NDSS/2021/understanding-the-growth-and-security-considerations-of-ecs', 'OUT', 'mention', null, 'EDNS Client Subnet'],
  ['USENIX/2021/assessing-browser-level-defense-against-idn-based-phishing', 'IN', 'lookalike', 'P', 'IDN homographs in .com and browser IDN display policies'],
  ['USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web', 'IN', 'dangling', 'P', 'subdomain takeover conditions across Tranco sites and what a takeover grants'],
  ['USENIX/2021/catching-phishers-by-their-bait-investigating-the-dutch-phishing-landscape-throu', 'CONTEXT', 'uses', null, 'phishing kits found via CT; lookalike names as the vehicle'],
  ['USENIX/2021/compromised-or-attacker-owned-a-large-scale-classification-and-study-of-hosting', 'CONTEXT', 'malicious-domains', null, 'compromised vs attacker-owned hosting domains of malicious URLs'],
  ['USENIX/2021/the-hijackers-guide-to-the-galaxy-off-path-taking-over-internet-resources', 'CONTEXT', 'dns-attack', null, 'off-path DNS attacks to take over registrar and RIR accounts'],
  ['USENIX/2021/weak-links-in-authentication-chains-a-large-scale-analysis-of-email-sender-spoof', 'OUT', 'mention', null, 'email sender spoofing; homograph in passing'],
  ['WWW/2021/privacy-policies-over-time-curation-and-analysis-of-a-million-document-dataset', 'OUT', 'mention', null, 'privacy policies; parked pages filtered as a cleaning step'],
  ['WWW/2021/security-of-alerting-authorities-in-the-www-measuring-namespaces-dnssec-and-web', 'OUT', 'mention', null, 'alerting-authority namespaces; typosquatting in related work'],
  ['WWW/2021/where-are-you-taking-me-understanding-abusive-traffic-distribution-systems', 'CONTEXT', 'uses', null, 'typosquatting sites as one of four traffic sources for TDS'],
  ['IEEE-SP/2022/bad-characters-imperceptible-nlp-attacks', 'OUT', 'homonym', null, 'homoglyphs in NLP inputs'],
  ['IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust', 'IN', 'residual', 'P', 're-registered 201 expired domains and logged residual traffic'],
  ['IEEE-SP/2022/measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds', 'IN', 'dangling', 'P', 'released cloud IPs still named by DNS records and configs'],
  ['IMC/2022/challenges-in-decentralized-name-management-the-case-of-ens', 'CONTEXT', 'other-namespace', null, 'ENS squatting and persistence'],
  ['IMC/2022/retroactive-identification-of-targeted-dns-infrastructure-hijacking', 'CONTEXT', 'dns-attack', null, 'targeted DNS infrastructure hijacks found in scans and CT'],
  ['USENIX/2022/exploring-the-unchartered-space-of-container-registry-typosquatting', 'CONTEXT', 'other-namespace', null, 'container-registry typosquatting (decision: pointer)'],
  ['USENIX/2022/helping-hands-measuring-the-impact-of-a-large-threat-intelligence-sharing-commun', 'OUT', 'mention', null, 'threat-intel blocklist; homoglyph keyword matching as a detail'],
  ['CCS/2023/iotflow-inferring-iot-device-behavior-at-scale-through-static-mobile-companion-a', 'IN', 'residual', 'S', 'section: abandoned (re-registrable) domains still used by IoT companion apps'],
  ['CCS/2023/txphishscope-towards-detecting-and-understanding-transaction-based-phishing-on-e', 'OUT', 'mention', null, 'transaction phishing; punycode as one feature'],
  ['IEEE-SP/2023/beyond-phish-toward-detecting-fraudulent-e-commerce-websites-at-scale', 'OUT', 'mention', null, 'fraudulent shops; WHOIS features'],
  ['IEEE-SP/2023/continuous-intrusion-characterizing-the-security-of-continuous-integration-servi', 'OUT', 'mention', null, 'CI services; typosquatting in passing'],
  ['IEEE-SP/2023/investigating-package-related-security-threats-in-software-registries', 'CONTEXT', 'other-namespace', null, 'package-registry typosquatting and dangling references'],
  ['IEEE-SP/2023/sok-taxonomy-of-attacks-on-open-source-software-supply-chains', 'OUT', 'mention', null, 'supply-chain taxonomy; typosquatting as one attack'],
  ['IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to', 'IN', 'residual', 'P', 'NXDOMAIN query volume in passive DNS; registered 19 NXDomains with honeypots'],
  ['IMC/2023/extended-dns-errors-unlocking-the-full-potential-of-dns-troubleshooting', 'OUT', 'mention', null, 'EDE codes; lame delegations as one error class'],
  ['IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls', 'IN', 'residual', 'P', 'certificates still valid after the domain changed hands'],
  ['IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d', 'IN', 'dangling', 'P', 'undelegated records on DNS hosting services, abused in the wild'],
  ['NDSS/2023/ghost-domain-reloaded-vulnerable-links-in-domain-name-delegation-and-revocation', 'CONTEXT', 'dns-attack', null, 'resolver implementations keep revoked delegations alive'],
  ['PETS/2023/comparing-large-scale-privacy-and-security-notifications', 'OUT', 'mention', null, 'notifications; parking-service bounces'],
  ['USENIX/2023/beyond-typosquatting-an-in-depth-look-at-package-confusion', 'CONTEXT', 'other-namespace', null, 'npm package-name confusion'],
  ['USENIX/2023/cookie-crumbles-breaking-and-fixing-web-session-integrity', 'OUT', 'mention', null, 'cookie integrity; subdomain takeover as the attacker model'],
  ['USENIX/2023/dscope-a-cloud-native-internet-telescope', 'OUT', 'mention', null, 'cloud telescope; IP-reuse traffic filtered out'],
  ['CCS/2024/a-first-look-at-security-and-privacy-risks-in-the-rapidapi-ecosystem', 'OUT', 'mention', null, 'API marketplace; typosquatting API hosts in passing'],
  ['CCS/2024/characterizing-and-mitigating-phishing-attacks-at-cctld-scale', 'CONTEXT', 'registration-data', null, 'registry-side view of phishing registrations in three ccTLDs'],
  ['IEEE-SP/2024/practical-attacks-against-dns-reputation-systems', 'OUT', 'mention', null, 'attacks on DNS reputation models'],
  ['IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s', 'IN', 'residual', 'S', 'section: bounced mail to unregistered or expired recipient domains that a squatter could register'],
  ['IMC/2024/darkdns-revisiting-the-value-of-rapid-zone-update', 'CONTEXT', 'registration-data', null, 'transient domains invisible to daily zone snapshots — source coverage'],
  ['IMC/2024/exploring-the-ecosystem-of-dns-https-resource-records-an-end-to-end-perspective', 'OUT', 'mention', null, 'HTTPS RR deployment'],
  ['IMC/2024/panning-for-gold-eth-understanding-and-analyzing-ens-domain-dropcatching', 'CONTEXT', 'other-namespace', null, 'ENS dropcatching (decision: pointer)'],
  ['NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services', 'IN', 'dangling', 'S', 'section: protective-DNS rewrites pointing at dangling cloud addresses'],
  ['PETS/2024/privacylens-on-device-pii-removal-from-rgb-images-using-thermally-enhanced-sensi', 'OUT', 'homonym', null, 'image processing ("squat" as a posture)'],
  ['USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure', 'IN', 'dangling', 'P', 'shared authoritative infrastructure lets another customer claim a zone'],
  ['USENIX/2024/donapi-malicious-npm-packages-detector-using-behavior-sequence-knowledge-mapping', 'OUT', 'mention', null, 'malicious npm packages; typosquatting in passing'],
  ['USENIX/2024/knowphish-large-language-models-meet-multimodal-knowledge-graphs-for-enhancing-r', 'OUT', 'mention', null, 'reference-based phishing detection'],
  ['USENIX/2024/rethinking-the-security-threats-of-stale-dns-glue-records', 'IN', 'dangling', 'P', 'stale glue in 1,096 TLD zones; takeover exposure'],
  ['USENIX/2024/the-imitation-game-exploring-brand-impersonation-attacks-on-social-media-platfor', 'CONTEXT', 'other-namespace', null, 'social-media handle squatting'],
  ['WWW/2024/hyperlink-hijacking-exploiting-erroneous-url-links-to-phantom-domains', 'IN', 'residual', 'P', 'links in Common Crawl to unregistered "phantom" domains; registered 51 and measured traffic'],
  ['WWW/2024/interface-illusions-uncovering-the-rise-of-visual-scams-in-cryptocurrency-wallet', 'OUT', 'mention', null, 'counterfeit tokens'],
  ['WWW/2024/investigations-of-top-level-domain-name-collisions-in-blockchain-naming-services', 'CONTEXT', 'other-namespace', null, 'blockchain naming-service TLD collisions'],
  ['WWW/2024/phishing-vs-legit-comparative-analysis-of-client-side-resources-of-phishing-and', 'OUT', 'mention', null, 'phishing page resources'],
  ['IEEE-SP/2025/restricting-the-link-effects-of-focused-attention-and-time-delay-on-phishing-war', 'OUT', 'mention', null, 'phishing warning experiment'],
  ['IMC/2025/analyzing-compliance-and-complications-of-integrating-internationalized-x-509-ce', 'OUT', 'mention', null, 'internationalised certificates; confusables in passing'],
  ['IMC/2025/measuring-the-deployment-of-dnssec-bootstrapping-using-authenticated-signals', 'OUT', 'mention', null, 'DNSSEC bootstrapping'],
  ['IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem', 'IN', 'dangling', 'S', 'section: 6k time servers with dangling upstream IP addresses'],
  ['IMC/2025/prefix2org-mapping-bgp-prefixes-to-organizations', 'OUT', 'mention', null, 'prefix-to-org mapping; IP WHOIS'],
  ['NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild', 'IN', 'residual', 'S', 'section: auto-configuration lookups to registrable domains (24,149 affected domains)'],
  ['NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange', 'IN', 'residual', 'S', 'section: resold domains and dangling domains sharing certificates with Tranco sites'],
  ['NDSS/2025/hades-attack-understanding-and-evaluating-manipulation-risks-of-email-blocklists', 'OUT', 'mention', null, 'DNSBL manipulation'],
  ['NDSS/2025/misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shortening-service', 'CONTEXT', 'mention-check', null, 'subdomain-takeover / expiry checks on allow-listed domains, no in-the-wild count'],
  ['NDSS/2025/secure-ip-address-allocation-at-cloud-scale', 'CONTEXT', 'mention-check', null, 'simulated IP-allocation policies against IP reuse; no in-the-wild measurement'],
  ['NDSS/2025/the-guardians-of-name-street-studying-the-defensive-registration-practices-of-the-fortune-500', 'IN', 'lookalike', 'P', 'defensive registrations of Fortune 500 companies'],
  ['NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem', 'IN', 'residual', 'S', 'section: Deno packages importing code from expired domains'],
  ['USENIX/2025/assessing-the-aftermath-the-effects-of-a-global-takedown-against-ddos-for-hire-s', 'OUT', 'mention', null, 'booter takedown; seized domains'],
  ['USENIX/2025/blockchain-address-poisoning', 'CONTEXT', 'other-namespace', null, 'lookalike wallet addresses'],
  ['USENIX/2025/evaluating-the-effectiveness-and-robustness-of-visual-similarity-based-phishing', 'OUT', 'mention', null, 'visual phishing detectors'],
  ['USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps', 'IN', 'residual', 'P', 'expired domains in Android apps\' DNS footprints, longitudinally'],
  ['USENIX/2025/misty-registry-an-empirical-study-of-flawed-domain-registry-operation', 'IN', 'dangling', 'P', 'registries leaving delegations of deleted ("relic") domains, stale glue, IDN twin takeover'],
  ['USENIX/2025/scanned-and-scammed-insecurity-by-obsqrity-measuring-user-susceptibility-and-awa', 'OUT', 'mention', null, 'QR-code user study'],
  ['USENIX/2025/url-inspection-tasks-helping-users-detect-phishing-links-in-emails', 'CONTEXT', 'user-study', null, 'users inspecting lookalike URLs'],
  ['WWW/2025/beyond-visual-confusion-understanding-how-inconsistencies-in-ens-normalization-f', 'CONTEXT', 'other-namespace', null, 'ENS normalisation and homoglyphs'],
  ['WWW/2025/pirates-of-charity-exploring-donation-based-abuses-in-social-media-platforms', 'OUT', 'mention', null, 'donation scams on platforms'],
  ['NDSS/2026/ctphishcapture-uncovering-credential-theft-based-phishing-scams-targeting-cryptocurrency-wallets', 'CONTEXT', 'uses', null, 'wallet phishing; typosquatted names as the vehicle'],
  ['NDSS/2026/indicator-of-benignity-an-industry-view-of-false-positive-in-malicious-domain-detection-and-its-mitigation', 'CONTEXT', 'malicious-domains', null, 'false positives in malicious-domain detection'],
  ['NDSS/2026/phishlang-a-real-time-fully-client-side-phishing-detection-framework-using-mobilebert', 'OUT', 'mention', null, 'client-side phishing detector; parked pages as a class'],
  ['NDSS/2026/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles', 'IN', 'lookalike', 'P', '90,153 UDRP cybersquatting disputes; transfers checked in zone files'],
  ['PETS/2026/dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android', 'IN', 'residual', 'P', 'lifecycle (expiry, re-registration, dangling CNAME) of 3,420 domains used by Android apps'],
  ['USENIX/2026/cutting-the-gordian-knot-detecting-malicious-pypi-packages-via-a-knowledge-minin', 'OUT', 'mention', null, 'malicious PyPI packages'],
  ['USENIX/2026/the-state-of-passkeys-studying-the-adoption-and-security-of-passkeys-on-the-web', 'CONTEXT', 'mention-check', null, 'related-origin registrability checked on an audited sample; subdomain takeover as exposure'],
  ['WWW/2026/hidden-in-plain-text-a-benchmark-for-social-web-indirect-prompt-injection-in-rag', 'OUT', 'mention', null, 'prompt injection; homoglyph text'],
];
 
// Selected for the corpus but no PDF was retrieved (empty data/fulltext directory), found by the
// title sweep over corpus2/.meta. They are not in the extraction and are NOT counted; the page
// cites the first two from author copies read by hand.
export const MISSING_FULLTEXT = [
  ['CCS/2016/all-your-dns-records-point-to-us-understanding-the-security-threats-of-dangling', 'dangling', 'the founding dangling-DNS measurement'],
  ['CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers', 'dangling', 'nameserver-domain expiry and typos as a hijack vector'],
  ['USENIX/2026/alias-equals-zone-large-scale-and-stealthy-takeover-of-domain-hosting-service-vi', 'dangling', 'CNAME-following verification at DNS hosting services'],
];
 
// Hand codes for the 48 IN papers, drafted from structured reading notes (notes/da_papers_*.md,
// one block per paper with verbatim quotes; checked by da_notes_quotecheck.mjs) and reviewed by
// the page author against those notes. Not double-coded.
export const HAND_FIELDS = {
  gen: {
    'typo-models': 'keyboard / edit-distance typo models (omission, insertion, substitution, transposition, missing dot, …)',
    combo: 'trademark plus added tokens (combosquatting)',
    bit: 'single bit flips',
    homoglyph: 'homoglyph / IDN confusables',
    sound: 'homophones (soundsquatting)',
    'named-tool': 'a named generator (dnstwist, URLCrazy, ShamFinder/SimChar, the authors\' own released tool)',
    'user-error': 'names produced by user error that is not a typo of a target (unintended URLs)',
    observed: 'no generator: names come from records, traffic, lists or apps',
  },
  src: {
    zone: 'TLD zone files (CZDS, registry agreement, open ccTLD AXFR, or a zone archive)',
    ct: 'Certificate Transparency / certificate scans',
    pdns: 'passive DNS',
    'active-dns': 'active DNS datasets or the authors\' own large-scale resolution',
    resolution: 'the authors resolved their own generated candidates',
    'drop-lists': 'pending-delete / drop lists, registry deletion data',
    whois: 'WHOIS, live or historical',
    rdap: 'RDAP',
    registry: 'registry- or ICANN-provided data, registry partner',
    'web-crawl': 'a web crawl or web corpus (own, Common Crawl, archives)',
    'app-traffic': 'app code or app traffic',
    toplist: 'a top list or company list as the target set',
    'threat-intel': 'blocklists and threat feeds as a source of names',
    'traffic-logs': 'traffic, query or delivery logs (ISP, enterprise, root servers, email provider)',
    'cache-snooping': 'public-resolver cache snooping',
    other: 'another source (dispute records, IP allocations, resolver or provider lists)',
  },
  whois: { none: 'not used', live: 'live WHOIS', historical: 'historical WHOIS product', rdap: 'RDAP' },
  use: {
    parked: 'parked / ads', defensive: 'defensive registration by the owner', 'redirect-target': 'redirects to the target',
    'redirect-other': 'redirects elsewhere', affiliate: 'affiliate abuse', malicious: 'malicious (blocklist, VirusTotal, manual)',
    phishing: 'phishing', 'for-sale': 'for sale', unused: 'unused / unregistered / no DNS', content: 'own content', error: 'error pages',
    'traffic-only': 'only the traffic it receives is measured', na: 'the paper does not classify what the names do',
  },
  label: { manual: 'researchers looked', heuristic: 'rules', classifier: 'trained classifier', blocklist: 'blocklist / VirusTotal / Safe Browsing', vendor: 'commercial categoriser or vendor feed', none: 'no labelling' },
  ethics: {
    approved: 'an IRB or ethics board approved (any part of) the study', exempt: 'an IRB ruled it exempt / not human-subjects research',
    'other-body': 'approved by a non-IRB body (general counsel, the partner\'s network department)', discussed: 'ethics section, no review body',
    'not-required': 'authors state no review was needed', none: 'nothing',
  },
  notify: { yes: 'notified someone (owners, providers, registries, CERT)', no: 'no notification stated', na: 'nothing to notify' },
  time: { longitudinal: 'repeated observation', snapshot: 'one observation window' },
  artifacts: { public: 'code or data public', promised: 'promised', request: 'on request', none: 'none mentioned' },
};
 
// [key, {gen, src, whois, use, label, reg (domains the authors registered; null = some, exact count not stated), claimed (third-party
//  names, zones, NS slots or cloud IPs the authors took control of), ethics, notify, time, artifacts}]
const H = (gen, src, whois, use, label, reg, claimed, ethics, notify, time, artifacts) => ({ gen, src, whois, use, label, reg, claimed, ethics, notify, time, artifacts });
export const HAND = [
  ['IMC/2010/an-empirical-study-of-orphan-dns-servers-in-the-internet', H(['observed'], ['zone', 'threat-intel'], ['none'], ['malicious', 'content'], ['heuristic', 'manual', 'blocklist'], 0, false, 'none', 'na', 'longitudinal', 'none')],
  ['WWW/2013/bitsquatting-exploiting-bit-flips-for-fun-or-profit', H(['bit'], ['toplist', 'resolution', 'web-crawl'], ['none'], ['parked', 'affiliate', 'malicious', 'redirect-other'], ['manual', 'heuristic', 'vendor'], 0, false, 'none', 'na', 'longitudinal', 'none')],
  ['USENIX/2014/the-long-taile-of-typosquatting-domain-names', H(['typo-models', 'named-tool'], ['zone', 'toplist', 'threat-intel', 'whois'], ['live'], ['parked', 'redirect-target', 'redirect-other', 'affiliate', 'malicious', 'phishing', 'defensive'], ['heuristic', 'classifier', 'manual', 'blocklist'], 0, false, 'none', 'na', 'longitudinal', 'none')],
  ['USENIX/2014/understanding-the-dark-side-of-domain-parking', H(['observed'], ['pdns', 'whois'], ['live'], ['parked', 'redirect-other', 'malicious', 'traffic-only'], ['heuristic', 'manual'], 23, false, 'discussed', 'no', 'longitudinal', 'none')],
  ['IEEE-SP/2015/every-second-counts-quantifying-the-negative-externalities-of-cybercrime-via-typ', H(['typo-models', 'observed'], ['traffic-logs', 'web-crawl', 'whois'], ['live'], ['defensive', 'redirect-target', 'malicious', 'parked', 'unused'], ['heuristic', 'manual', 'blocklist'], 0, false, 'exempt', 'na', 'longitudinal', 'none')],
  ['IMC/2015/from-academy-to-zone-an-analysis-of-the-new-tld-land-rush', H(['observed'], ['zone', 'registry', 'whois', 'active-dns', 'web-crawl', 'toplist'], ['live'], ['parked', 'unused', 'defensive', 'redirect-other', 'content', 'for-sale', 'error'], ['classifier', 'manual', 'heuristic'], 0, false, 'none', 'na', 'longitudinal', 'none')],
  ['NDSS/2015/parking-sensors-analyzing-and-detecting-parked-domains', H(['observed', 'typo-models'], ['zone', 'whois', 'toplist', 'web-crawl'], ['live'], ['parked', 'redirect-other', 'malicious'], ['heuristic', 'manual', 'classifier'], 1, false, 'none', 'no', 'snapshot', 'none')],
  ['NDSS/2015/seven-months-worth-of-mistakes-a-longitudinal-study-of-typosquatting-abuse', H(['typo-models'], ['toplist', 'resolution', 'web-crawl', 'whois'], ['live'], ['parked', 'defensive', 'redirect-target', 'redirect-other', 'affiliate', 'malicious', 'content', 'for-sale', 'error'], ['heuristic', 'manual'], 0, false, 'none', 'no', 'longitudinal', 'public')],
  ['IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in', H(['observed'], ['zone', 'drop-lists', 'threat-intel', 'whois'], ['historical'], ['malicious', 'redirect-other', 'unused'], ['heuristic'], 0, false, 'none', 'yes', 'longitudinal', 'none')],
  ['IEEE-SP/2016/mitm-attack-by-name-collision-cause-analysis-and-vulnerability-assessment-in-the', H(['observed'], ['traffic-logs', 'zone', 'whois', 'registry'], ['historical'], ['unused', 'na'], ['heuristic'], 0, false, 'discussed', 'no', 'longitudinal', 'none')],
  ['IMC/2016/whois-lost-in-translation-mis-understanding-domain-name-expiration-and-re-regist', H(['observed'], ['zone', 'whois'], ['live'], ['na'], ['heuristic'], 0, false, 'none', 'no', 'longitudinal', 'none')],
  ['CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study', H(['observed'], ['traffic-logs'], ['none'], ['na'], ['manual', 'heuristic'], 1, false, 'none', 'no', 'snapshot', 'none')],
  ['CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse', H(['combo'], ['pdns', 'active-dns', 'ct', 'threat-intel', 'toplist', 'whois'], ['live'], ['phishing', 'affiliate', 'malicious', 'parked', 'error', 'content'], ['manual', 'heuristic', 'vendor', 'blocklist'], 0, false, 'none', 'no', 'longitudinal', 'none')],
  ['IMC/2017/email-typosquatting', H(['typo-models'], ['zone', 'whois'], ['live'], ['na'], ['heuristic', 'manual'], 76, false, 'approved', 'na', 'longitudinal', 'promised')],
  ['USENIX/2017/game-of-registrars-an-empirical-analysis-of-post-expiration-domain-name-takeover', H(['observed'], ['drop-lists', 'whois', 'registry'], ['live'], ['parked', 'for-sale', 'malicious', 'error'], ['manual'], 0, false, 'none', 'na', 'longitudinal', 'none')],
  ['IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri', H(['observed'], ['drop-lists', 'rdap', 'whois'], ['rdap', 'live'], ['malicious'], ['blocklist'], 0, false, 'none', 'no', 'snapshot', 'none')],
  ['IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild', H(['homoglyph', 'typo-models', 'bit', 'combo', 'named-tool'], ['active-dns', 'toplist', 'whois'], ['live'], ['phishing'], ['classifier', 'manual'], 0, false, 'none', 'yes', 'snapshot', 'public')],
  ['WWW/2018/panning-for-gold-com-understanding-the-dynamics-of-domain-dropcatching', H(['observed'], ['zone', 'drop-lists', 'whois', 'web-crawl'], ['live'], ['parked', 'error', 'malicious', 'affiliate', 'content', 'unused'], ['classifier', 'heuristic', 'manual', 'blocklist', 'vendor'], 0, false, 'none', 'na', 'longitudinal', 'none')],
  ['CCS/2019/you-are-who-you-appear-to-be-a-longitudinal-study-of-domain-impersonation-in-tls', H(['typo-models', 'combo', 'homoglyph'], ['ct', 'whois', 'toplist'], ['live'], ['malicious'], ['blocklist'], 0, false, 'approved', 'na', 'longitudinal', 'public')],
  ['IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs', H(['homoglyph', 'named-tool'], ['zone', 'toplist', 'pdns'], ['none'], ['parked', 'redirect-other', 'for-sale', 'error', 'malicious', 'content', 'defensive'], ['heuristic', 'manual', 'blocklist'], 0, false, 'discussed', 'yes', 'snapshot', 'public')],
  ['NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs', H(['observed'], ['pdns', 'whois', 'threat-intel'], ['live', 'historical'], ['malicious', 'redirect-other'], ['heuristic', 'manual', 'blocklist'], 0, true, 'none', 'yes', 'longitudinal', 'none')],
  ['CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr', H(['observed'], ['toplist', 'pdns', 'other', 'whois'], ['live'], ['na'], ['vendor'], null, false, 'discussed', 'yes', 'longitudinal', 'none')],
  ['IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers', H(['observed'], ['cache-snooping'], ['none'], ['traffic-only'], ['none'], 0, false, 'discussed', 'yes', 'longitudinal', 'public')],
  ['IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations', H(['observed'], ['zone', 'active-dns', 'whois'], ['live'], ['unused', 'error', 'malicious', 'parked', 'defensive'], ['heuristic', 'manual'], 0, false, 'discussed', 'yes', 'longitudinal', 'none')],
  ['IMC/2021/risky-bizness-risks-derived-from-registrar-name-management', H(['observed'], ['zone', 'whois'], ['historical'], ['parked', 'redirect-other', 'unused'], ['heuristic', 'manual'], 5, true, 'other-body', 'yes', 'longitudinal', 'none')],
  ['NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media', H(['user-error'], ['other', 'web-crawl'], ['none'], ['content', 'parked', 'malicious', 'unused'], ['manual', 'blocklist', 'classifier'], 45, false, 'exempt', 'no', 'longitudinal', 'public')],
  ['USENIX/2021/assessing-browser-level-defense-against-idn-based-phishing', H(['homoglyph'], ['zone', 'toplist'], ['none'], ['na'], ['none'], 0, false, 'approved', 'yes', 'snapshot', 'public')],
  ['USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web', H(['observed'], ['toplist', 'ct', 'other', 'whois'], ['live'], ['unused', 'redirect-other', 'malicious'], ['heuristic', 'manual'], 0, false, 'discussed', 'yes', 'snapshot', 'none')],
  ['IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust', H(['observed'], ['pdns', 'drop-lists'], ['none'], ['traffic-only'], ['heuristic', 'manual'], 201, false, 'discussed', 'na', 'longitudinal', 'none')],
  ['IEEE-SP/2022/measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds', H(['observed'], ['other', 'toplist'], ['none'], ['traffic-only'], ['manual', 'heuristic'], 0, true, 'exempt', 'yes', 'longitudinal', 'none')],
  ['CCS/2023/iotflow-inferring-iot-device-behavior-at-scale-through-static-mobile-companion-a', H(['observed'], ['app-traffic', 'whois'], ['live'], ['unused'], ['manual'], 0, false, 'discussed', 'yes', 'snapshot', 'public')],
  ['IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to', H(['observed'], ['pdns', 'whois'], ['historical'], ['malicious', 'unused'], ['vendor', 'blocklist'], 19, false, 'discussed', 'yes', 'longitudinal', 'request')],
  ['IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls', H(['observed'], ['ct', 'whois', 'zone'], ['historical'], ['malicious'], ['vendor', 'heuristic', 'manual'], 0, false, 'not-required', 'na', 'longitudinal', 'none')],
  ['IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d', H(['observed'], ['toplist', 'pdns', 'other'], ['none'], ['malicious'], ['blocklist', 'heuristic'], 0, true, 'discussed', 'yes', 'snapshot', 'public')],
  ['IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s', H(['observed', 'named-tool'], ['traffic-logs', 'active-dns', 'whois'], ['live'], ['unused'], ['heuristic'], 30, false, 'other-body', 'yes', 'longitudinal', 'none')],
  ['NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services', H(['observed'], ['active-dns', 'other'], ['none'], ['unused'], ['heuristic'], 0, false, 'other-body', 'yes', 'snapshot', 'public')],
  ['USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure', H(['observed'], ['zone', 'toplist', 'whois'], ['live'], ['unused'], ['heuristic', 'manual'], 0, true, 'discussed', 'yes', 'snapshot', 'none')],
  ['USENIX/2024/rethinking-the-security-threats-of-stale-dns-glue-records', H(['observed'], ['zone', 'active-dns'], ['none'], ['na'], ['none'], null, true, 'discussed', 'yes', 'longitudinal', 'none')], // "more than 15" new domains: a lower bound, coded null (review F3)
  ['WWW/2024/hyperlink-hijacking-exploiting-erroneous-url-links-to-phantom-domains', H(['observed'], ['web-crawl', 'zone', 'active-dns'], ['none'], ['traffic-only'], ['heuristic', 'manual'], 51, false, 'approved', 'no', 'longitudinal', 'none')],
  ['IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem', H(['observed'], ['active-dns', 'other'], ['none'], ['unused'], ['heuristic'], 0, false, 'discussed', 'no', 'snapshot', 'request')],
  ['NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild', H(['observed'], ['toplist', 'other'], ['none'], ['unused'], ['heuristic'], 2, false, 'discussed', 'yes', 'snapshot', 'none')],
  ['NDSS/2025/cross-origin-web-attacks-via-http-2-server-push-and-signed-http-exchange', H(['observed'], ['whois', 'active-dns', 'ct', 'pdns', 'toplist'], ['live', 'historical'], ['unused'], ['heuristic'], 1, false, 'discussed', 'yes', 'longitudinal', 'none')],
  ['NDSS/2025/the-guardians-of-name-street-studying-the-defensive-registration-practices-of-the-fortune-500', H(['typo-models', 'bit', 'homoglyph', 'sound', 'combo'], ['zone', 'pdns', 'whois', 'toplist'], ['live', 'historical'], ['defensive'], ['heuristic', 'manual'], 0, false, 'discussed', 'no', 'longitudinal', 'public')],
  ['NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem', H(['observed'], ['app-traffic'], ['none'], ['unused', 'for-sale'], ['manual', 'heuristic'], 0, false, 'discussed', 'yes', 'longitudinal', 'none')],
  ['USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps', H(['observed'], ['app-traffic', 'pdns', 'whois'], ['historical'], ['unused', 'malicious', 'parked', 'content'], ['manual', 'heuristic'], 0, false, 'discussed', 'yes', 'longitudinal', 'public')],
  ['USENIX/2025/misty-registry-an-empirical-study-of-flawed-domain-registry-operation', H(['observed'], ['zone', 'whois', 'other'], ['live', 'historical'], ['defensive', 'unused', 'redirect-other', 'phishing'], ['manual', 'heuristic'], 80, false, 'discussed', 'yes', 'longitudinal', 'promised')],
  ['NDSS/2026/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles', H(['observed'], ['other', 'zone', 'threat-intel'], ['none'], ['malicious'], ['blocklist', 'classifier', 'manual'], 0, false, 'none', 'na', 'longitudinal', 'public')],
  ['PETS/2026/dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android', H(['observed'], ['app-traffic', 'whois', 'active-dns', 'ct'], ['live'], ['unused', 'redirect-other', 'malicious'], ['heuristic', 'manual'], 0, false, 'discussed', 'yes', 'longitudinal', 'public')],
];
 
// Of the papers that registered or claimed names, those that then LOGGED the traffic, mail or
// queries arriving for someone else (review G11: the 19 include lab testbeds, localhost-pointed
// test names and names on which nothing was deployed). [key, what was logged]
export const LOGGED_ARRIVALS = [
  ['IMC/2017/email-typosquatting', 'mail sent to 76 typo domains, content scrubbed and encrypted'],
  ['NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media', 'visit counts on 45 unintended-URL domains'],
  ['IMC/2021/risky-bizness-risks-derived-from-registrar-name-management', 'incoming DNS queries to 5 sacrificial-nameserver domains, never answered'],
  ['IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust', 'requests to 201 re-registered expired domains'],
  ['IEEE-SP/2022/measuring-and-mitigating-the-risk-of-ip-reuse-on-public-clouds', 'unsolicited traffic to 1.5 million released cloud IPs'],
  ['IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to', 'queries and requests to 19 registered NXDomains'],
  ['WWW/2024/hyperlink-hijacking-exploiting-erroneous-url-links-to-phantom-domains', 'web-server logs on 51 phantom domains'],
];

The fold behind PASS E. Its unmapped residue (14 strings among the population's population[].sourceList values) is printed in the report output above.

da_source_fold.mjs

// da_source_fold.mjs — fold for the data sources named by domain-abuse papers:
// population[].sourceList and tools[].name (used/produced). Multi-label: a string may
// hit several families (e.g. "ICANN .com zone file via CZDS" is zone-czds AND zone-file).
// Order does not matter; every string that hits no family is returned as residue and printed
// by report_domain_abuse.mjs. The families answer "where did the names / registration data
// come from", not "what was measured".
 
export const SOURCE_FAMILIES = [
  ['zone-czds', 'ICANN Centralized Zone Data Service', /\bCZDS\b|Centrali[sz]ed Zone Data/i],
  ['zone-file', 'a TLD zone file or zone transfer, however obtained', /zone[- ]?(file|transfer|data|snapshot)s?|\bzones?\b.*\b(com|net|org|TLD)s?\b|TLD zone|registr(y|ies)'?s? DNS zone/i],
  ['zone-aggregate', 'a third party\'s archive of zone files (DZDB, DNS Coffee, DNS Census, domainlists.io, Domains Project, DomainScope)', /DZDB|DNS Coffee|DNS Census|domainlists|Domains Project|DomainScope/i],
  ['ct', 'Certificate Transparency logs', /Certificate Transparency|\bCT logs?\b|crt\.sh|certstream/i],
  ['scan-dataset', 'Internet-wide scan datasets (Censys, Rapid7)', /Censys|Rapid7/i],
  ['pdns', 'passive DNS (Farsight/DNSDB/SIE or other)', /passive[- ]?DNS|DNSDB|Farsight|\bSIE\b|\bPDNS\b/i],
  ['active-dns', 'active DNS measurement datasets (Active DNS Project, OpenINTEL)', /Active ?DNS|OpenINTEL/i],
  ['drop', 'drop / pending-delete lists and drop-catch services', /pending[- ]delete|dropped|drop[- ]?catch|SnapNames|NameJet|Dynadot|\bPool\b|backorder|Graveyard/i],
  ['whois', 'WHOIS (live or historical, any client)', /whois/i],
  ['rdap', 'RDAP', /\bRDAP\b/i],
  ['registry', 'registry- or ICANN-provided data (monthly reports, registration logs, a registry partner)', /registry reports|ICANN (monthly )?(registry )?reports|registrar IDs|industry partner|registration logs|delegated TLD strings|collected internally by Verisign/i],
  ['toplist', 'a top list (Alexa, Tranco, Umbrella, Majestic, Fortune 500)', /Alexa|Tranco|Umbrella|Majestic|Fortune 500/i],
  ['web-corpus', 'a web corpus or archive (Common Crawl, Internet Archive)', /Common ?Crawl|Internet Archive|Wayback/i],
  ['threat-intel', 'blocklists, VirusTotal, Safe Browsing, threat feeds', /VirusTotal|Safe Browsing|black ?list|block ?list|PhishTank|Spamhaus|URIBL|feeds?\b|Malware Patrol|Viruswatch|Team Cymru|Trend ?Micro|McAfee|SpamAssassin|EasyList|APT reports/i],
  ['traffic', 'traffic or query logs (ISP, enterprise proxy, email delivery, root/TLD query data, Netflow)', /\blogs?\b|Netflow|\bTAP\b|\bPROXY\b|DITL|NXD|streaming API|traffic/i],
  ['apps', 'app stores and APK corpora', /AndroZoo|Google Play|APK|Mozilla store|deno\.land/i],
  ['resolvers-hosts', 'resolver, nameserver or hosting-provider lists and IPv4-wide scans', /resolver|DNS (hosting )?providers?|DNS vendors|IPv4|port-53|NTP|DNS Server List|DNS implementations|hosting providers/i],
  ['dispute', 'domain-dispute providers (UDRP)', /WIPO|FORUM|ADNDRC|CIIDRC|\bCAC\b/i],
];
 
// Strings that are method components, not sources: excluded from the residue on purpose,
// each listed so that the exclusion is visible.
export const NOT_A_SOURCE = /^(custom|Tian et al\.|Amazon Mechanical Turk|Amazon MTurk|Qualtrics|Twitter users|Enron email corpus|industry partner)/i;
 
export function foldSource(s) {
  const fams = SOURCE_FAMILIES.filter(([, , re]) => re.test(s)).map(([k]) => k);
  return fams;
}

da_notes_quotecheck-output.txt

notes/da_papers_A.md: 198 of 276 quotes located
notes/da_papers_B_group1.md: 61 of 65 quotes located
notes/da_papers_B_group2.md: 58 of 62 quotes located
notes/da_papers_B_group3.md: 63 of 66 quotes located
notes/da_papers_B_group4.md: 86 of 88 quotes located
notes/da_papers_C_part1.md: 63 of 68 quotes located
notes/da_papers_C_part2.md: 66 of 72 quotes located
notes/da_papers_C_part3.md: 83 of 90 quotes located
notes/da_papers_C_part4.md: 83 of 87 quotes located
notes/da_papers_D.md: 195 of 255 quotes located
 
ALL: 956 of 1129 quotes located (84.7%)
 
NOT LOCATED (173):
  IMC/2010/an-empirical-study-of-orphan-dns-servers-in-the-internet
    "Start date of zone files 2009-04-01 / Days of zone files used 31 Days ... Start date of malicious feeds 2009-04-16 / Days of malicious feeds used 14 Days"
  IMC/2010/an-empirical-study-of-orphan-dns-servers-in-the-internet
    "We classify the type of content on these orphans by performing keyword searches on the returned pages and manual inspection. We find that they primarily served advertisements or contained blogs or sca"
  IEEE-SP/2015/every-second-counts-quantifying-the-negative-externalities-of-cybercrime-via-typ
    "Beyond domain registrar information from whois, we can also inspect the name server responsible for resolving the typo domains."
  IEEE-SP/2015/every-second-counts-quantifying-the-negative-externalities-of-cybercrime-via-typ
    "Adversarial registration. This is the activity most commonly thought of as 'typosquatting:' registration of a lexically similar domain by an unaffiliated party which does not link directly to the targ"
  IEEE-SP/2015/every-second-counts-quantifying-the-negative-externalities-of-cybercrime-via-typ
    "Because of the pre-analysis anonymization of the data, the Institutional Review Board determined this research to not be human subjects research due to its lack of personally identifying information a"
  IEEE-SP/2015/every-second-counts-quantifying-the-negative-externalities-of-cybercrime-via-typ
    "users at the TAP location lost 1,205,060 seconds, or just under two weeks of time"
  IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in
    "we define the set of all domains that expired and were potential targets of residual trust abuse as DZ = DG ∩ (DM ∪ DB )."
  IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in
    " residual trust based on which side of expiration the blacklist/malware hit falls on, using purely temporal-set-intersection logic (no manual content labeling of the mass dataset; the five worked case"
  IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in
    " For validation of the Alembic ranking itself: "
  IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in
    "We offered our survey results of possible outages, similar to ben.edu, to the DNS community. An enterprise DNS company now provides secondary services for schools that formerly relied on expired or ex"
  IEEE-SP/2016/domain-z-28-registrations-later-measuring-the-exploitation-of-residual-trust-in
    "While identifying changes in domain ownership would appear to be straightforward using WHOIS information, mining WHOIS is a challenging and resource-intensive task... simply obtaining WHOIS informatio"
  CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse
    "The passive DNS dataset (PDNS) consists of DNS traffic collected since 2011, above a recursive DNS server located in the largest Internet Service Provider (ISP) in the US."
  CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse
    "We also utilize an active DNS (ADNS) dataset, which we obtain daily from the Active DNS project."
  CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse
    "Using public Advanced Persistent Threat (APT) reports, we manually extract and verify domain names used in such documented attacks."
  CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse
    "A security company provides us with spam trap data that is labeled using their proprietary detection engine (SPA)."
  CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse
    "The labeling was performed by the authors where each one chose among the following labels: social engineering (surveys, scams such as tech support scam, malicious downloads), trademark abuse (websites"
  CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse
    "we built an infrastructure of 100 scriptable browser instances and used them to crawl 1.3 million combosquatting domains... we identify 2,573 unique domains that were, for at least one day, involved i"
  CCS/2017/hiding-in-plain-sight-a-longitudinal-study-of-combosquatting-abuse
    "Our decision to use only the US-centric popular Alexa domains is due to the underlying datasets we use for our long-term study (which are mostly US-centric)."
  IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild
    "We select domains that are ranked high by Alexa... For each category, we select the top 50 websites (850 domains in total). Then we search for brands that are popular targets of real-world phishing at"
  IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild
    "We obtained a snapshot of 224,810,532 DNS records from the ActiveDNS project on September 6, 2017. ActiveDNS project uses multiple seeds to run active DNS probing, covering a number of top-level domai"
  IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild
    "We present ... false positive (FP), false negative (FN) ... and accuracy (ACC). We show that Random Forest has the highest [performance]."
  IMC/2018/needle-in-a-haystack-tracking-down-elite-phishing-domains-in-the-wild
    "Our study has a number of limitations. First, our crawler only sets two profiles for a specific version of iPhone (mobile) and Chrome (web). It is possible that we might have missed phishing pages tha"
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    " eight public blacklists, and 19 verified sinkhole operators' NS/IP lists, spanning six years. "
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "we resorted to the historical WHOIS data provided by our industry collaborator. This dataset covers around 55% of our malicious domains DM."
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    " unique domains. Table I lists 19 sinkhole operators including "
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "we used a commercial tool to perform a reverse WHOIS lookup on an FBI email cyd-dns@ic.fbi.gov. WHOIS lookup returned a list of around 1,700 domains."
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "Then, the domain was dropped by the registrar and re-registered again on 2010-06-17 with another registrar (i.e., 101domain), based on historical WHOIS information."
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "We marked each domain's PDNS record with one of [several take-down-related labels]... this problem, the algorithm in Section III-C might inaccurately label some domains due to the limited number of sn"
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "We first reported this issue to the FBI (via cyd-dns@ic.fbi.gov found on WHOIS record retrieved on 2018-05-20). We did not hear back from them probably because the domain had expired already. Therefor"
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "we reported this issue to Afilias, the .info TLD registry, and provided them the list of problematic domains."
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "we discovered over 620K taken-down domains and conducted a longitudinal analysis on the take-down process."
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "We queried this API twice every week starting from October 2017 until May 2018 to monitor whether these taken-down domains were on the market."
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "we discovered over 620K taken-down domains and conducted a longitudinal analysis on the take-down process"
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "expired sinkholes have caused the transfer of around 30K taken-down domains whose traffic is now under the control of new owners"
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "the take-down lifecycle (i.e., sinkhole duration and active duration) is limited by the 'visibility' of PDNS. Therefore, if a domain's TLD is not within its daily feed list of supported TLDs zone set,"
  NDSS/2019/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs
    "we can not rely on historical blacklists to prove malicious reuse of taken-down domains due to the limited overlap between sinkholed domains and blacklists,"
  IMC/2021/risky-bizness-risks-derived-from-registrar-name-management
    "the primary data set we use is the zone file data in CAIDA-DZDB. The data set covers nine years of daily snapshots of zone files from April 2011 through September 2020. As of September 2020, CAIDA-DZD"
  IMC/2021/risky-bizness-risks-derived-from-registrar-name-management
    " a hijacker used, then manually visited to determine use (mostly parking/SEO), not via a trained classifier. "
  IMC/2021/risky-bizness-risks-derived-from-registrar-name-management
    "because our Institutional Review Board (IRB) is focused squarely on overseeing human subjects research (which this work is not), they were in no position to give us independent oversight. For this rea"
  IMC/2021/risky-bizness-risks-derived-from-registrar-name-management
    "Beginning in September 2020, we initiated a broad outreach effort to communicate our findings to the registrar community... to remediate remediation, we notified the top ten registrars with the most a"
  IMC/2021/risky-bizness-risks-derived-from-registrar-name-management
    "for a brief period of time, 1.6 million domains (including tiktok.com) had dangling delegations that would have permitted hijacking... only 51,699 of the original 1.6M domains still delegated to a sac"
  IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust
    "We use a commercial passive DNS database as our proxy to gauge DNS activity for a given domain and attempt to re-register domains with a high number of pre-expiration resolutions."
  IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust
    "The domain selection module performed daily queries to Domainmonster, DynaDot, NameJet, Pool, and SnapNames to obtain a list of domains that were about to expire."
  IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust
    "We use a commercial passive DNS database as our proxy..."
  IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust
    " via handcrafted filters per protocol (residual-path requests, credential attempts, fingerprint JS execution), followed by manual case-study investigation of high-volume domains. "
  IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust
    "Our analysis for SSH, FTP, and Telnet traffic resulted in only one IP address tagged as trust, and it was a false positive."
  IEEE-SP/2022/domains-do-change-their-spots-quantifying-potential-abuse-of-residual-trust
    " section describing precautions and reasoning, without describing board review. "
  IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls
    " classes (key compromise, registrant change, managed-TLS departure), no target brand list or lexical generation is used. "
  IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls
    "We first extracted the domains from all publicly available zone files from the Centralized Zone Data Service (CZDS), which includes the popular org, com, and net zones. We resolved each domain on a da"
  IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls
    " registry-controlled fields for .com/.net to sidestep registrar inconsistency and GDPR redaction, with the redaction problem explicitly named as a source of undercount. "
  IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls
    "the rapid growth of privacy-preserving WHOIS in recent years makes registrant tracking exceedingly difficult."
  IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls
    "We used VirusTotal (VT) to determine the reputation of domains found on stale certificates. We analyzed a random sample of 100K domains with stale certificates from domain owner change... We used AVCl"
  IMC/2023/stale-tls-certificates-investigating-precarious-third-party-access-to-valid-tls
    "Our detection method misses intra- and inter-registrar domain transfers, as well as pre-release re-registration, both of which update existing registrations rather than creating a new registration wit"
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure
    " nameserver group (identical IP or overlapping backend) discovered by clustering TLD zone-file NS/IP pairs, restricted to the popular subset. "
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure
    " Vulnerable domains are then confirmed only among "
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure
    "we gathered 1,090 authorized zone files through ICANN's Centralized Zone Data Service, covering 19 generic TLDs (gTLDs) like .com and .org, along with 1,071 new gTLDs like .site and .xyz... we limited"
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure
    " (DNS hosting providers, web hosting providers, registrars, individual corporations/governments/media sites) via HTTP+WHOIS heuristics plus manual disambiguation, and separately confirms exploitabilit"
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure
    " accounts with hosting/DNS providers and, for real production domains already delegated to non-hosting nameservers with REFUSED status, claimed hosting of those domains just long enough to inject a pr"
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure
    "Our experiments were conducted with strict adherence to ethical considerations. These were guided by the principles of the Menlo Report and established best practices for network measurement."
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure
    "We responsibly disclosed to the affected service providers and corporations in compliance with vulnerability disclosure principles. Both Anon.C and Amazon Route 53 have acknowledged this vulnerability"
  USENIX/2024/cross-the-zone-toward-a-covert-domain-hijacking-via-shared-dns-infrastructure
    ") used to enumerate shared-infrastructure groups, with the active exploitation testing conducted once per candidate group rather than repeated over time. "
  NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild
    " string via a registrar API. "
  NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild
    "(1) Tranco1M, a list from the Tranco ranking generated [on a given date, footnoted with a download link]."
  NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild
    "Using the GoDaddy API, we identified 224 registrable autoconfig.tld domains."
  NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild
    " or not to the A2 attack scenario (client would query an attacker-registrable configuration domain) based on the deterministic parsing-condition check, not manual/ML labeling. "
  NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild
    "For the centralized ISPDB database, we raised an issue on GitHub and attached all the domains with outdated configurations, which was confirmed by the developers and has been updated."
  NDSS/2025/automatic-insecurity-exploring-email-auto-configuration-in-the-wild
    "31,281 domains (involving 675 TLDs) meet the attack conditions... Using the GoDaddy API, we identified 224 registrable autoconfig.tld domains... In total, 24,149 domains were susceptible."
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    " are eTLD+1 domains empirically contacted by real Android apps during dynamic execution, later checked for expiration and re-registrability. "
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    " Registrability of expired candidates was checked directly with a registrar rather than inferred: "
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    "The primary sources for our app dataset are the Google Play Store, the AndroZoo dataset, and the VirusTotal database."
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    "We also depend on Farsight DNSDB, a commercial passive DNS database, to provide historical DNS resolution data for the domains that are contacted during execution of an app version... their database c"
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    " section describing precautions (generic, non-targeted app interaction; 9-minute interaction cap; no login bypass) and a disclosure attempt to affected app developers that mostly failed to elicit a su"
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    "The original research artifacts cannot be made available to the public as they are governed by the terms of the first author's employment... Artifacts. On the other hand, we are able to open-source ar"
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    "the average percentage of APKs using an expired domain is 2.0% and 2.5% for first-order and second-order footprints respectively, and the average percentage of apps respectively is 3.3% and 4.2%."
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    "voodoo-ads.io ... 49 [apps] 111 [APKs] ... Top App Rank 6 ... Downloads 100M+."
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    "Of the 11 apps that are listed in 'Top App' and still available on Google Play, 9 of them have changed their code in their latest versions such that the domains are no longer statically defined"
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    "The main limitations of our work are the data sources... since the app sample requires apps to have multiple update[s]... the resulting dataset is [biased toward longer-lived, frequently updated apps]"
  USENIX/2025/lost-in-the-mists-of-time-expirations-in-dns-footprints-of-mobile-apps
    "our approach to deduce domain expirations from passive DNS records does not have ground truth."
  IMC/2015/from-academy-to-zone-an-analysis-of-the-new-tld-land-rush
    "We include results for new TLDs that started general availability by the date of publication of ICANN's latest monthly registry re- ports on January 31, 2015, which altogether totals 502 new TLDs."
  IEEE-SP/2016/mitm-attack-by-name-collision-cause-analysis-and-vulnerability-assessment-in-the
    " domains are the WPAD query names observed leaking from internal namespaces to the public DNS root for new gTLD strings, filtered by a persistence/volume definition the authors call "
  IEEE-SP/2016/mitm-attack-by-name-collision-cause-analysis-and-vulnerability-assessment-in-the
    "We anonymize the email addresses of the registrants for privacy consid- erations."
  IEEE-SP/2016/mitm-attack-by-name-collision-cause-analysis-and-vulnerability-assessment-in-the
    "We anonymize the email addresses of the registrants for privacy consid- erations."
  IMC/2017/email-typosquatting
    " (with honeytokens/honey accounts) to third-party typosquatting domains not owned by the authors, to test for credential-theft interest: «a second experiment in which we send "
  CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr
    " via the authors' own scanner, ZreFinder, which diffs TLD-level vs SLD-level NS record sets for each domain in a target list to find stale ("
  CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr
    "we found that the Zaw threat is completely real- istic: we successfully exploited our own domains at various leading DNS hosting providers and the resolvers maintained by major op- erators."
  CCS/2020/zombie-awakening-stealthy-hijacking-of-active-domains-through-dns-hosting-referr
    "we found that the Zaw threat is completely real- istic: we successfully exploited our own domains at various leading DNS hosting providers and the resolvers maintained by major op- erators."
  NDSS/2021/to-err-is-human-characterizing-the-threat-of-unintended-urls-in-social-media
    "-prefixed URLs, non-English tweets, URLs with deep paths/subdomains, and "
  IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d
    " (UR) threat from dangling DNS: an attacker hosts DNS records for a domain it does not own on a lax hosting provider, without ever compromising or needing the target domain itself to be stale/deleted/"
  IMC/2023/wolf-in-sheeps-clothing-evaluating-security-risks-of-the-undelegated-record-on-d
    "avoid burdening any DNS server. In particular, on average, we only queried a server once every 130 seconds while collecting re- sponses from different DNS servers (authoritative servers and open resol"
  USENIX/2025/misty-registry-an-empirical-study-of-flawed-domain-registry-operation
    " (auto-created IDN-variant domains sharing nameservers, some redirect-target/defensive by design but exploitable), "
  USENIX/2025/misty-registry-an-empirical-study-of-flawed-domain-registry-operation
    " (resurrected vs. untapped — appear delegated but unregistered/expired, i.e. unused/dangling), and stale ("
  USENIX/2014/the-long-taile-of-typosquatting-domain-names
    " terminology (originally around the "
  IMC/2016/whois-lost-in-translation-mis-understanding-domain-name-expiration-and-re-regist
    "Under their ICANN agreements, registries grant researchers access to daily snapshots of their DNS zone files, that is, the data used to run the zone's name servers-a list of all second-level domain na"
  IMC/2016/whois-lost-in-translation-mis-understanding-domain-name-expiration-and-re-regist
    "we retain the domains in the right shaded interval as \"
  IMC/2016/whois-lost-in-translation-mis-understanding-domain-name-expiration-and-re-regist
    " expirations, and those in the left shaded interval as \"
  IMC/2016/whois-lost-in-translation-mis-understanding-domain-name-expiration-and-re-regist
    "represent only a tiny fraction overall (0.1 % of com domains are re-registered before day 40), they again con-"
  USENIX/2017/game-of-registrars-an-empirical-analysis-of-post-expiration-domain-name-takeover
    "We inspect a random sample of 50 drop-catch domains six months after the re-registration, and find that 23 are parked and display a \"
  USENIX/2017/game-of-registrars-an-empirical-analysis-of-post-expiration-domain-name-takeover
    "; for the 75%/80%/9.5% figures the denominators are "
  CCS/2019/you-are-who-you-appear-to-be-a-longitudinal-study-of-domain-impersonation-in-tls
    "We use the same methodology for identifying typosquatting as used by Agten et al. [5]. They define typosquatting as one of five mutations: add a character, delete a character, swap two adjacent charac"
  CCS/2019/you-are-who-you-appear-to-be-a-longitudinal-study-of-domain-impersonation-in-tls
    "detecting combosquatting requires ignoring target domains whose brands are substrings of common English words, such as apple.com, att.com (because of words like \"
  IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers
    "varies from 10% to −50%, with the exception of one unusual Cloud- flare location where our error is 75% (Section 5)."
  IMC/2020/trufflehunter-cache-snooping-rare-domains-at-large-public-dns-resolvers
    "We refrain from probing caches of other \"
  USENIX/2021/assessing-browser-level-defense-against-idn-based-phishing
    " of homograph IDN registrations because the browser policies focus on the impersonation behavior rather than the intent. ... We defer the more in-depth analysis of the registrants' intent to future wo"
  USENIX/2021/assessing-browser-level-defense-against-idn-based-phishing
    " sentence naming Chrome/Safari/Firefox teams is present in the source but is split across an interleaved two-column line break in paper.cols.txt — dropped rather than risk a garbled quote; the "
  USENIX/2021/assessing-browser-level-defense-against-idn-based-phishing
    " under the same repo, and "
  CCS/2023/iotflow-inferring-iot-device-behavior-at-scale-through-static-mobile-companion-a
    " is on-topic for domain-abuse/residual trust. Several fields below are `not stated` because the rest of the paper does not address candidate-generation-style domain abuse. paper.cols.txt is a two-colu"
  CCS/2023/iotflow-inferring-iot-device-behavior-at-scale-through-static-mobile-companion-a
    "unused / available for re-registration"
  IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s
    " (available for re-registration; some already re-registered) via active DNS + registrar-API availability check (heuristic pipeline, not a classifier/blocklist); usernames are separately checked as "
  IMC/2024/bounce-in-the-wild-a-deep-dive-into-email-delivery-failures-from-a-large-email-s
    "expired/re-registered, residual trust"
  WWW/2024/hyperlink-hijacking-exploiting-erroneous-url-links-to-phantom-domains
    "), described as continuing "
  NDSS/2025/the-guardians-of-name-street-studying-the-defensive-registration-practices-of-the-fortune-500
    " despite corroborating evidence), and there is no estimate of how many such cases are missed; findable-in-zone-files but not-yet-flagged-as-defensive third-party WHOIS lookups for every one of the 146"
  NDSS/2026/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles
    "post-hoc: what happens after a squatted domain is caught"
  NDSS/2026/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles
    " does not appear anywhere in this paper (verified by full-text search), and there is no IRB/board mention. There is one privacy/harm-avoidance safeguard described in the artifact appendix — withholdin"
  USENIX/2014/understanding-the-dark-side-of-domain-parking
    " set is the population of parked domains discovered from parking-service infrastructure, not typo/combo/homoglyph names of a target list. Quote: "
  USENIX/2014/understanding-the-dark-side-of-domain-parking
    " domains and to verify identity consistency when registering with parking services; notes that some WHOIS records did not reveal ownership. Quote: "
  USENIX/2014/understanding-the-dark-side-of-domain-parking
    "/UICs) plus an external tool for primary/secondary classification. Quote: "
  USENIX/2014/understanding-the-dark-side-of-domain-parking
    " (traffic stealing). Quote: "
  USENIX/2014/understanding-the-dark-side-of-domain-parking
    "the 24 million monetization chains we collected from leading parking services over 5.5 months."
  CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study
    " strings are extracted directly from leaked DNS queries, filtered to TLD strings that match delegated new gTLDs. Quote: "
  CCS/2017/client-side-name-collision-vulnerability-in-the-new-gtld-era-a-systematic-study
    " Non-registered service name candidates were then pruned with "
  IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri
    " label via a vendor blocklist (Google Safe Browsing) to a subset of re-registered domains, explicitly caveated as not indicating intent or origin. Quote: "
  IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri
    "); re-registration outcomes checked once, ≥8 weeks after each deletion. Quote: "
  IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri
    "Figure 2 shows that no .com domain is re-registered before 7 pm UTC. One hour later, around 9.4 % of all .com domains become available for re-registration during the Drop."
  IMC/2018/from-deletion-to-re-registration-in-zero-seconds-domain-registrar-behaviour-duri
    "Because the volume of .net domains on the pending delete list was nearly an order of magnitude smaller, we restricted our lookups to .com domains. In light of our findings in Section 4.1, this decisio"
  IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs
    "), not dnstwist/URLCrazy. Quote: "
  IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs
    "Data ... Collection time ... zone file [42] 140,900,279 952,352 (0.67%) May 2019"
  IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs
    "we conducted the analysis using the passive DNS [9], which is a DNS monitoring"
  IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs
    " (Table 12), and a separate targeted-brand classification "
  IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs
    " (Table 13). Labeling is heuristic/manual: NS-record lists for known parking companies, screenshots taken via a headless browser (puppeteer) inspected manually, and blocklist checks (VirusTotal, hpHos"
  IMC/2019/shamfinder-an-automated-framework-for-detecting-idn-homographs
    "We applied the blacklists to 3,280 of detected IDN homographs, which include non-active domains... UC ∪ SimChar 242 13 8"
  IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations
    "Between March and May 2020 we queried over 49 million domains: 13 million randomly sampled domains from .com, 13 million randomly sampled domains from the combined set of all ngTLDs, and all domains f"
  IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations
    "Our primary data set is a large collection of zone files from the dns.coffee4 service [9]. This data set contains daily snapshots of zone files from April 2011 through January 2020, covering nearly ni"
  IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations
    "Surprisingly, domains continued to point to these unresolv[able nameservers, and] based on whois information, the domains were renewed in the grace period avoiding a repeat of the hijacking seen with "
  IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations
    "This data set contains daily snapshots of zone files from April 2011 through January 2020, covering nearly nine years."
  IMC/2020/unresolved-issues-prevalence-persistence-and-perils-of-lame-delegations
    "Given the intrusive nature and overhead of exhaustive probing, we limit the number of domains we actively probe."
  USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web
    "We enumerated the subdomains of the top 50k domains in the Tranco list [42] from March 2020. The enumeration phase was based on amass [41], a state of the art information gathering tool backed by the "
  USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web
    " appendix, no IRB/board named); large-scale responsible-disclosure campaign, including routing unreachable contacts through a national CERT, with a follow-up remeasurement to check fix rates. Quote: "
  USENIX/2021/can-i-take-your-subdomain-exploring-same-site-attacks-in-the-modern-web
    "F-Secure awarded us with €250 for the reported subdomain takeover vulnerability."
  IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to
    "we retrieve historical WHOIS information and leverage WhoisXML [31] that contains 15.6 billion historic WHOIS records."
  IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to
    "To reveal the history of domain ownership and registration, we join the NXDomains identified in the Farsight passive DNS database with the WHOIS history database [31] to reveal an NXDomain's registrat"
  IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to
    "our commercial identification algorithm finds 45,175 domains used for typosquatting attacks, 38,900 domains for combosquatting attacks, 6,090 are dotsquatting attacks, 313 for bitsquatting attacks, an"
  IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to
    " for 6 months, passively recording all incoming traffic (never responding/interacting). PII collected (phone numbers, models, country codes) was anonymized and then deleted before publication; authors"
  IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to
    "), citing precedent studies; no IRB/board explicitly named. Safeguards: domain-selection criteria to avoid depriving the public of desirable names, passive-only honeypot, a public landing page with co"
  IMC/2023/dial-n-for-nxdomain-the-scale-origin-and-security-implications-of-dns-queries-to
    "we randomly select 20 million expired NXDomains for investigation. In total, we uncover 483,887 NXDomains with historical records of hosting malicious activities."
  NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services
    " are the security-orientated DNS resources (cloud-hosted "
  NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services
    " IPs and sinkhole CNAME domains) already in use by identified protective-DNS (PDNS) services, tested for whether they are now dangling. Quote: "
  NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services
    "A comparison of ASNs and PTR records with these services reveals 61 cloud IPs employed by 693 PDNSes... To identify seizable IPs, we use a two-step process, we first assess host reachability using ICM"
  NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services
    ") sinkhole CNAME domains; both are candidates for hijacking a PDNS's rewrite mechanism. Labeling is heuristic/network-based (reachability + open-port checks), not manual content review or a classifier"
  NDSS/2024/understanding-the-implementation-and-security-implications-of-protective-dns-services
    "); no IRB (institution lacks one) but authorized/supervised by the authors' network management department, following Belmont/Menlo Report principles; results only partially released and anonymized; vu"
  IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem
    " section referencing the Menlo Report; permission obtained from a cloud provider (Alibaba Cloud) to use it as a measurement vantage point; PTR opt-out mechanism for scanned networks; academic-committe"
  IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem
    "), nested within an otherwise longitudinal measurement campaign (66 weekly scan rounds). Quote: "
  IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem
    " in one part of the analysis and "
  IMC/2025/measuring-the-time-source-vulnerabilities-in-the-ntp-ecosystem
    " in another, since NTP mode-6 (used to identify static-configuration software versions) is disabled on most servers, forcing indirect inference. Quote: "
  NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem
    "we used deno.land's official API to collect and download deno.land packages on our local server... As a result, we collected 5,400 packages with associated repositories, which represent the subject of"
  NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem
    "we monitored the target URLs starting from 14th of December 2022 to 15th of December 2023... This script runs twice a day, once every twelve hours."
  NDSS/2025/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem
    " finding is stated without describing whether a whois/registrar check was used. Quote: "
  PETS/2026/dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android
    " baseline snapshot; active measurement "
  PETS/2026/dead-domains-living-data-a-privacy-risk-analysis-of-domain-lifecycle-in-android
    "on May 5, 2026 we submitted a detailed report via the Google Bug Hunters (Google VRP) portal... on May 7, 2026 the Google VRP rejected the report as 'Out of Scope.'"
  CCS/2016/all-your-dns-records-point-to-us-understanding-the-security-threats-of-dangling-dns-records
    ") against cloud provider IP ranges (AWS, Azure); WHOIS and registrar checks for expired-domain confirmation. Quote: "
  CCS/2016/all-your-dns-records-point-to-us-understanding-the-security-threats-of-dangling-dns-records
    "we automatically search for the four types of Dares using Algorithm 1. Given the resolving chain of a domain, we recursively check the data field of every DNS record in the chain."
  CCS/2016/all-your-dns-records-point-to-us-understanding-the-security-threats-of-dangling-dns-records
    "due to its probabilistic nature, IPScouter cannot enumerate the whole IP address space."
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "We generated 605,965 domain bit-flips from the top 10,000 NSDOMs and their dependencies as in the work by Dinaburg [13]."
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "we obtained the zone files of the top five gTLDs (com, net, org, xyz and info) with respect to the number of second-level domains present in their zones [15]. For each domain name in each zone file, w"
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "on December 15, 2016, we obtained the zone files."
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "Based on WHOIS data, at least the five most resolved domains using ns2.[*]tal.co.uk are all owned by the same entity."
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "we did not respond to requests for domain names we did not own, instead allowing them to timeout as they would in the case of an unexploited bit-flip."
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    " paragraphs) with concrete safeguards (short TTLs, no response to third-party domains, no exploitation of found WHOIS/email vulnerabilities); WHOIS-inaccuracy findings were reported to ICANN, but no m"
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "on December 15, 2016, we obtained the zone files of the top five gTLDs."
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "Overall, we find that over 12,000 domains are susceptible to near-immediate compromise, while 52.8M domains are being targeted by nameserver bitsquatters that respond with rogue IP addresses. Addition"
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "In total, we conservatively estimate that 12,945 domains are directly or indirectly exposed to being hijacked through a configuration error related to their nameserver."
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "Of the 882,653 available typosquatting NSDOMs, 2,276 were actively used as nameservers by 6,213 misconfigured domains... registering just 6 typosquatting NSDOMs allows for the immediate compromise of "
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "Over a one month period (Dec 22, 2016 - Jan 22, 2017), we received 734,300 DNS requests on NS M1 for all six registered typosquatting nameservers domains... we logged 3,013,420 'follow-up' DNS request"
  CCS/2017/the-wolf-of-name-street-hijacking-domains-through-their-nameservers
    "To reduce false positives, we conservatively consider only those typosquatting NSDOMs where the target domain has NS records for both the authoritative, as well as the typosquatting NSDOM. Hence, we e"

The 41 entries this run appended (40 in the first save, Roberts et al. in a second after the generic review added the citation) to bibliography. Eleven further keys the content page cites were already there.

bib_additions_domain_abuse.bib

@inproceedings{adjibi2025_guardians,
  author        = {Adjibi, Boladji Vinny and Avgetidis, Athanasios and Antonakakis, Manos and Bailey, Michael and Monrose, Fabian},
  title         = {The Guardians of Name Street: Studying the Defensive Registration Practices of the Fortune 500},
  booktitle     = {Proceedings of the Network and Distributed System Security Symposium},
  year          = {2025},
  series        = {NDSS 2025},
  url           = {https://www.ndss-symposium.org/ndss-paper/the-guardians-of-name-street-studying-the-defensive-registration-practices-of-the-fortune-500/},
}
@inproceedings{adjibi2026_udrp,
  author        = {Adjibi, Vinny and Avgetidis, Athanasios and Antonakakis, Manos and Dainotti, Alberto and Bailey, Michael and Monrose, Fabian},
  title         = {Repairing Trust in Domain Name Disputes Practices: Insights from a Quarter-Century’s Worth of Squabbles},
  booktitle     = {Proceedings of the Network and Distributed System Security Symposium},
  year          = {2026},
  series        = {NDSS 2026},
  url           = {https://www.ndss-symposium.org/ndss-paper/repairing-trust-in-domain-name-disputes-practices-insights-from-a-quarter-centurys-worth-of-squabbles/},
}
@inproceedings{akiwate2020_lame,
  author        = {Akiwate, Gautam and Jonker, Mattijs and Sommese, Raffaele and Foster, Ian D. and Voelker, Geoffrey M. and Savage, Stefan and Claffy, K. C.},
  title         = {Unresolved Issues: Prevalence, Persistence, and Perils of Lame Delegations},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2020},
  series        = {IMC 2020},
  doi           = {10.1145/3419394.3423623},
}
@inproceedings{akiwate2021_risky,
  author        = {Akiwate, Gautam and Savage, Stefan and Voelker, Geoffrey M. and Claffy, Kimberly C.},
  title         = {Risky BIZness: risks derived from registrar name management},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2021},
  series        = {IMC 2021},
  doi           = {10.1145/3487552.3487816},
}
@inproceedings{alhamdan2025_deno,
  author        = {AlHamdan, Abdullah and Staicu, Cristian-Alexandru},
  title         = {Welcome to Jurassic Park: A Comprehensive Study of Security Risks in Deno and its Ecosystem},
  booktitle     = {Proceedings of the Network and Distributed System Security Symposium},
  year          = {2025},
  series        = {NDSS 2025},
  url           = {https://www.ndss-symposium.org/ndss-paper/welcome-to-jurassic-park-a-comprehensive-study-of-security-risks-in-deno-and-its-ecosystem/},
}
@inproceedings{alowaisheq2019_cracking,
  author        = {Alowaisheq, Eihal and Wang, Peng and Alrwais, Sumayah and Liao, Xiaojing and Wang, XiaoFeng and Alowaisheq, Tasneem and Mi, Xianghang and Tang, Siyuan and Liu, Baojun},
  title         = {Cracking the Wall of Confinement: Understanding and Analyzing Malicious Domain Take-downs},
  booktitle     = {Proceedings of the Network and Distributed System Security Symposium},
  year          = {2019},
  series        = {NDSS 2019},
  url           = {https://www.ndss-symposium.org/ndss-paper/cracking-the-wall-of-confinement-understanding-and-analyzing-malicious-domain-take-downs/},
}
@inproceedings{alowaisheq2020_zombie,
  author        = {Alowaisheq, Eihal and Tang, Siyuan and Wang, Zhihao and Alharbi, Fatemah and Liao, Xiaojing and Wang, XiaoFeng},
  title         = {Zombie Awakening: Stealthy Hijacking of Active Domains through DNS Hosting Referral},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2020},
  series        = {CCS 2020},
  doi           = {10.1145/3372297.3417864},
}
@inproceedings{alrwais2014_parking,
  author        = {Alrwais, Sumayah and Yuan, Kan and Alowaisheq, Eihal and Li, Zhou and Wang, XiaoFeng},
  title         = {Understanding the Dark Side of Domain Parking},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2014},
  series        = {USENIX Security 2014},
  url           = {https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/alrwais},
}
@inproceedings{chen2016_mitm,
  author        = {Chen, Qi Alfred and Osterweil, Eric and Thomas, Matthew and Mao, Zhuoqing Morley},
  title         = {MitM Attack by Name Collision: Cause Analysis and Vulnerability Assessment in the New gTLD Era},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2016},
  series        = {IEEE S&P 2016},
  doi           = {10.1109/sp.2016.46},
}
@inproceedings{halvorson2015_academy,
  author        = {Halvorson, Tristan and Der, Matthew F. and Foster, Ian D. and Savage, Stefan and Saul, Lawrence K. and Voelker, Geoffrey M.},
  title         = {From .academy to .zone: An Analysis of the New TLD Land Rush},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2015},
  series        = {IMC 2015},
  doi           = {10.1145/2815675.2815696},
}
@inproceedings{hortea2026_dead,
  author        = {Hortea, Gabriel and Girish, Aniketh and Vallina-Rodriguez, Narseo and Tapiador, Juan},
  title         = {Dead Domains, Living Data: A Privacy Risk Analysis of Domain Lifecycle in Android Apps},
  booktitle     = {Proceedings on Privacy Enhancing Technologies},
  year          = {2026},
  series        = {PoPETs 2026},
  doi           = {10.56553/popets-2026-0112},
}
@inproceedings{hu2021_idn,
  author        = {Hu, Hang and Jan, Steve T.K. and Wang, Yang and Wang, Gang},
  title         = {Assessing Browser-level Defense against IDN-based Phishing},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2021},
  series        = {USENIX Security 2021},
  url           = {https://www.usenix.org/conference/usenixsecurity21/presentation/hu-hang},
}
@inproceedings{kalafut2010_orphan,
  author        = {Kalafut, Andrew J. and Gupta, Minaxi and Cole, Christopher A. and Chen, Lei and Myers, Nathan E.},
  title         = {An empirical study of orphan DNS servers in the internet},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2010},
  series        = {IMC 2010},
  doi           = {10.1145/1879141.1879182},
}
@inproceedings{khan2015_every,
  author        = {Khan, Mohammad Taha and Huo, Xiang and Li, Zhou and Kanich, Chris},
  title         = {Every Second Counts: Quantifying the Negative Externalities of Cybercrime via Typosquatting},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2015},
  series        = {IEEE S&P 2015},
  doi           = {10.1109/sp.2015.16},
}
@inproceedings{kintis2017_hiding,
  author        = {Kintis, Panagiotis and Miramirkhani, Najmeh and Lever, Charles and Chen, Yizheng and Gómez, Rosa Romero and Pitropakis, Nikolaos and Nikiforakis, Nick and Antonakakis, Manos},
  title         = {Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abuse},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2017},
  series        = {CCS 2017},
  doi           = {10.1145/3133956.3134002},
}
@inproceedings{lauinger2016_whois,
  author        = {Lauinger, Tobias and Onarlioglu, Kaan and Chaabane, Abdelberi and Robertson, William and Kirda, Engin},
  title         = {WHOIS Lost in Translation: (Mis)Understanding Domain Name Expiration and Re-Registration},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2016},
  series        = {IMC 2016},
  doi           = {10.1145/2987443.2987463},
}
@inproceedings{lauinger2017_game,
  author        = {Lauinger, Tobias and Chaabane, Abdelberi and Buyukkayhan, Ahmet Salih and Onarlioglu, Kaan and Robertson, William},
  title         = {Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2017},
  series        = {USENIX Security 2017},
  url           = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/lauinger},
}
@inproceedings{lauinger2018_deletion,
  author        = {Lauinger, Tobias and Buyukkayhan, Ahmet Salih and Chaabane, Abdelberi and Robertson, William K. and Kirda, Engin},
  title         = {From Deletion to Re-Registration in Zero Seconds: Domain Registrar Behaviour During the Drop},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2018},
  series        = {IMC 2018},
  doi           = {10.1145/3278532.3278560},
}
@inproceedings{lever2016_domainz,
  author        = {Lever, Chaz and Walls, Robert J. and Nadji, Yacin and Dagon, David and McDaniel, Patrick D. and Antonakakis, Manos},
  title         = {Domain-Z: 28 Registrations Later Measuring the Exploitation of Residual Trust in Domains},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2016},
  series        = {IEEE S&P 2016},
  doi           = {10.1109/sp.2016.47},
}
@inproceedings{liu2015_whois,
  author        = {Liu, Suqi and Foster, Ian D. and Savage, Stefan and Voelker, Geoffrey M. and Saul, Lawrence K.},
  title         = {Who is .com?: Learning to Parse WHOIS Records},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2015},
  series        = {IMC 2015},
  doi           = {10.1145/2815675.2815693},
}
@inproceedings{liu2016_dangling,
  author        = {Liu, Daiping and Hao, Shuai and Wang, Haining},
  title         = {All Your DNS Records Point to Us: Understanding the Security Threats of Dangling DNS Records},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2016},
  series        = {CCS 2016},
  doi           = {10.1145/2976749.2978387},
}
@inproceedings{liu2022_container,
  author        = {Liu, Guannan and Gao, Xing and Wang, Haining and Sun, Kun},
  title         = {Exploring the Unchartered Space of Container Registry Typosquatting},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2022},
  series        = {USENIX Security 2022},
  url           = {https://www.usenix.org/conference/usenixsecurity22/presentation/liu-guannan},
}
@inproceedings{ma2023_stale,
  author        = {Ma, Zane and Faulkenberry, Aaron and Papastergiou, Thomas and Durumeric, Zakir and Bailey, Michael D. and Keromytis, Angelos D. and Monrose, Fabian and Antonakakis, Manos},
  title         = {Stale TLS Certificates: Investigating Precarious Third-Party Access to Valid TLS Keys},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2023},
  series        = {IMC 2023},
  doi           = {10.1145/3618257.3624802},
}
@inproceedings{miramirkhani2018_panning,
  author        = {Miramirkhani, Najmeh and Barron, Timothy and Ferdman, Michael and Nikiforakis, Nick},
  title         = {Panning for gold.com: Understanding the Dynamics of Domain Dropcatching},
  booktitle     = {Proceedings of the ACM Web Conference},
  year          = {2018},
  series        = {TheWebConf 2018},
  doi           = {10.1145/3178876.3186092},
}
@inproceedings{muzammil2024_panning,
  author        = {Muzammil, Muhammad and Wu, Zhengyu and Balasubramanian, Aruna and Nikiforakis, Nick},
  title         = {Panning for gold.eth: Understanding and Analyzing ENS Domain Dropcatching},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2024},
  series        = {IMC 2024},
  doi           = {10.1145/3646547.3689009},
}
@inproceedings{neupane2023_confusion,
  author        = {Neupane, Shradha and Holmes, Grant and Wyss, Elizabeth and Davidson, Drew and De Carli, Lorenzo},
  title         = {Beyond Typosquatting: An In-depth Look at Package Confusion},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2023},
  series        = {USENIX Security 2023},
  url           = {https://www.usenix.org/conference/usenixsecurity23/presentation/neupane},
}
@inproceedings{nikiforakis2013_bitsquatting,
  author        = {Nikiforakis, Nick and Van Acker, Steven and Meert, Wannes and Desmet, Lieven and Piessens, Frank and Joosen, Wouter},
  title         = {Bitsquatting: exploiting bit-flips for fun, or profit?},
  booktitle     = {Proceedings of the ACM Web Conference},
  year          = {2013},
  series        = {TheWebConf 2013},
  doi           = {10.1145/2488388.2488474},
}
@inproceedings{pauley2022_ipreuse,
  author        = {Pauley, Eric and Sheatsley, Ryan and Hoak, Blaine and Burke, Quinn and Beugin, Yohan and McDaniel, Patrick D.},
  title         = {Measuring and Mitigating the Risk of IP Reuse on Public Clouds},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2022},
  series        = {IEEE S&P 2022},
  doi           = {10.1109/sp46214.2022.9833784},
}
@inproceedings{saric2024_hyperlink,
  author        = {Saric, Kevin and Savins, Felix and Ramachandran, Gowri Sankar and Jurdak, Raja and Nepal, Surya},
  title         = {Hyperlink Hijacking: Exploiting Erroneous URL Links to Phantom Domains},
  booktitle     = {Proceedings of the ACM Web Conference},
  year          = {2024},
  series        = {TheWebConf 2024},
  doi           = {10.1145/3589334.3645510},
}
@inproceedings{so2022_spots,
  author        = {So, Johnny and Miramirkhani, Najmeh and Ferdman, Michael and Nikiforakis, Nick},
  title         = {Domains Do Change Their Spots: Quantifying Potential Abuse of Residual Trust},
  booktitle     = {Proceedings of the IEEE Symposium on Security and Privacy},
  year          = {2022},
  series        = {IEEE S&P 2022},
  doi           = {10.1109/sp46214.2022.9833609},
}
@inproceedings{so2025_lost,
  author        = {So, Johnny and Sanchez-Rola, Iskander and Nikiforakis, Nick},
  title         = {Lost in the Mists of Time: Expirations in DNS Footprints of Mobile Apps},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2025},
  series        = {USENIX Security 2025},
  url           = {https://www.usenix.org/conference/usenixsecurity25/presentation/so},
}
@inproceedings{sommese2024_darkdns,
  author        = {Sommese, Raffaele and Akiwate, Gautam and Affinito, Antonia and Müller, Moritz and Jonker, Mattijs and Claffy, K. C.},
  title         = {DarkDNS: Revisiting the Value of Rapid Zone Update},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2024},
  series        = {IMC 2024},
  doi           = {10.1145/3646547.3689021},
}
@inproceedings{suzuki2019_shamfinder,
  author        = {Suzuki, Hiroaki and Chiba, Daiki and Yoneya, Yoshiro and Mori, Tatsuya and Goto, Shigeki},
  title         = {ShamFinder: An Automated Framework for Detecting IDN Homographs},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2019},
  series        = {IMC 2019},
  doi           = {10.1145/3355369.3355587},
}
@inproceedings{szurdi2014_taile,
  author        = {Szurdi, Janos and Kocso, Balazs and Cseh, Gabor and Spring, Jonathan and Felegyhazi, Mark and Kanich, Chris},
  title         = {The Long “Taile” of Typosquatting Domain Names},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2014},
  series        = {USENIX Security 2014},
  url           = {https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/szurdi},
}
@inproceedings{vissers2015_parking,
  author        = {Vissers, Thomas and Joosen, Wouter and Nikiforakis, Nick},
  title         = {Parking Sensors: Analyzing and Detecting Parked Domains},
  booktitle     = {Proceedings of the Network and Distributed System Security Symposium},
  year          = {2015},
  series        = {NDSS 2015},
  url           = {https://www.ndss-symposium.org/ndss2015/ndss-2015-programme/parking-sensors-analyzing-and-detecting-parked-domains/},
}
@inproceedings{vissers2017_wolf,
  author        = {Vissers, Thomas and Barron, Timothy and Van Goethem, Tom and Joosen, Wouter and Nikiforakis, Nick},
  title         = {The Wolf of Name Street: Hijacking Domains Through Their Nameservers},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2017},
  series        = {CCS 2017},
  doi           = {10.1145/3133956.3133988},
}
@inproceedings{zhang2023_wolf,
  author        = {Zhang, Fenglu and Zhang, Yunyi and Liu, Baojun and Alowaisheq, Eihal and Ying, Lingyun and Li, Xiang and Zhang, Zaifeng and Liu, Ying and Duan, Haixin and Zhang, Min},
  title         = {Wolf in Sheep's Clothing: Evaluating Security Risks of the Undelegated Record on DNS Hosting Services},
  booktitle     = {Proceedings of the ACM Internet Measurement Conference},
  year          = {2023},
  series        = {IMC 2023},
  doi           = {10.1145/3618257.3624839},
}
@inproceedings{zhang2024_cross,
  author        = {Zhang, Yunyi and Zhang, Mingming and Liu, Baojun and Liu, Zhan and Zhang, Jia and Duan, Haixin and Zhang, Min and Shi, Fan and Xu, Chengxi},
  title         = {Cross the Zone: Toward a Covert Domain Hijacking via Shared DNS Infrastructure},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2024},
  series        = {USENIX Security 2024},
  url           = {https://www.usenix.org/conference/usenixsecurity24/presentation/zhang-yunyi-zone},
}
@inproceedings{zhang2024_glue,
  author        = {Zhang, Yunyi and Liu, Baojun and Duan, Haixin and Zhang, Min and Li, Xiang and Shi, Fan and Xu, Chengxi and Alowaisheq, Eihal},
  title         = {Rethinking the Security Threats of Stale DNS Glue Records},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2024},
  series        = {USENIX Security 2024},
  url           = {https://www.usenix.org/conference/usenixsecurity24/presentation/zhang-yunyi-rethinking},
}
@inproceedings{zhang2025_misty,
  author        = {Zhang, Mingming and Zhang, Yunyi and Liu, Baojun and Duan, Haixin and Zhang, Min and Shi, Fan and Xu, Chengxi},
  title         = {Misty Registry: An Empirical Study of Flawed Domain Registry Operation},
  booktitle     = {Proceedings of the USENIX Security Symposium},
  year          = {2025},
  series        = {USENIX Security 2025},
  url           = {https://www.usenix.org/conference/usenixsecurity25/presentation/zhang-mingming},
}
@inproceedings{roberts2019_impersonation,
  author        = {Roberts, Richard and Goldschlag, Yaelle and Walter, Rachel and Chung, Taejoong and Mislove, Alan and Levin, Dave},
  title         = {You Are Who You Appear to Be: A Longitudinal Study of Domain Impersonation in TLS Certificates},
  booktitle     = {Proceedings of the ACM SIGSAC Conference on Computer and Communications Security},
  year          = {2019},
  series        = {CCS 2019},
  doi           = {10.1145/3319535.3363188},
}