Measure The Web

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Domain abuse: squatting, parking, expired domains and dangling DNS ======

You are about to measure names that attract traffic or trust meant for someone else: a typo of a bank's domain, a brand name with ''-login'' appended, a domain that expired last month and still receives the old owner's email, a ''CNAME'' that points at a cloud bucket nobody owns any more. The measurement is the same four steps every time — **generate or collect candidate names, find out which are registered or configured, decide what each one does, and (sometimes) register or claim a few to see what arrives** — and each step has a decision that fixes what your number means:

  - **The generator is the population.** Whatever permutation model, token list or record source you use decides which squats exist for you. Two squatting models over the same brands describe populations two orders of magnitude apart.
  - **The registration source decides what you can see.** A daily zone snapshot, a Certificate Transparency stream and passive DNS each miss a different slice, and since 2018 WHOIS no longer tells you who registered the name.
  - **"Registered" is not "abused".** Most lookalike names are parked, for sale, unused, or registered by the brand itself. A count of lookalikes without a use label and a defensive-registration check measures the registration market, not abuse.
  - **Registering a name to see what it receives is an intervention.** Nineteen papers in this population registered or took control of names, and seven of them logged the traffic, mail or queries that arrived for someone else. What they kept, and what they did with the name afterwards, differs from paper to paper — and [[Practices:Ethics]] does not yet answer the question.

This page is about **the namespace itself as the measured object**: which names exist, who holds them, what they do, and what trust they inherit. Three neighbours own the adjacent questions. [[Design:DNS]] owns //resolution// measurement — which resolver answered what. [[Security:Phishing]] owns what a lookalike is //used for// once it serves a phishing page; this page stops at "the squatted name serves a phish" and hands over. [[Security:TLS certificates]] owns Certificate Transparency as a data source; this page uses CT only as one of several ways to find names. Squatting in namespaces that are not DNS — package registries, container images, app identifiers, voice skills, social handles, blockchain names — is counted as context, not population; the fourteen papers are listed on [[provenance:security:domain_abuse]].

<WRAP important>
**A count of lookalike or expired names is not a finding.** Four measured facts a methods section has to survive:

  * **The generator is the population.** Kintis et al. matched 268 trademarks against six years of passive and active DNS and found combosquatting domains — brand plus extra tokens — **100 times more prevalent** than typosquatting domains {[kintis2017_hiding]}. A study that generates only keyboard typos has measured the smaller of the two populations and cannot say so.
  * **Most registrations are not abuse, and some are the brand's own.** Of 146,397,537 candidate names generated for the Fortune 500, **402,934** were registered and **19,523 (4.84%)** of those were identified as defensive registrations by the companies themselves {[adjibi2025_guardians]}. Ten years earlier only **156** of the Alexa top 500 had any defensive registration of their five-model typos {[agten2015_seven]}.
  * **Residual trust is cheap to buy and heavy.** Re-registering 201 expired domains at an average of **$7.29** each brought **650,737,621** requests from **5,540,379** IP addresses in four months {[so2022_spots]}. On the day they are deleted, **10%** of all ''.com'' domains are re-registered {[lauinger2017_game]}.
  * **Dangling delegations are a registrar practice, not an accident.** Registrars renaming nameservers to "sacrificial" hostnames exposed **512,715** domains over nine years, and **163,827 (31.95%)** of those were actually taken over by someone registering the sacrificial name {[akiwate2021_risky]}.

State your generator, your registration source and its date, how you told defensive registrations from squats, and what you registered yourself. "We found 40,000 typosquatting domains" states none of them.
</WRAP>

===== What to read first =====

^ Paper ^ Why now ^
| Kintis et al., CCS 2017 {[kintis2017_hiding]} | Why the generator decides the population: combosquatting from passive and active DNS, 2.7 million domains, and how long abusive ones live. Read it before choosing a permutation model. |
| Adjibi et al., NDSS 2025 {[adjibi2025_guardians]} | **Current** lookalike design: every major permutation family over the Fortune 500, zone files plus WHOIS plus three years of ISP passive DNS, and a strict rule for what counts as a brand's own registration. The paper that makes "is this a squat or the owner?" a measured question. |
| Agten et al., NDSS 2015 {[agten2015_seven]} | The classic longitudinal typosquatting crawl — five typo models, Alexa top 500, daily for seven months, a 13-way use taxonomy, released data. Historical as a target list; still the template for labelling what a squat does. |
| Vissers et al., NDSS 2015 {[vissers2015_parking]} | How to recognise a parked page, with a classifier and eight million parked domains. Parking is a common end state for squatted, speculative and expired names, so a parking detector belongs in any pipeline. |
| Lauinger et al., USENIX Security 2017 {[lauinger2017_game]} and Miramirkhani et al., TheWebConf 2018 {[miramirkhani2018_panning]} | Expiry and drop-catching: who re-registers deleted names, how fast, and what they do with them. |
| So et al., IEEE S&P 2022 {[so2022_spots]} | Re-registering expired domains and logging what still arrives. The method, its cost, and an ethics section worth copying — and one outcome worth not repeating (see [[#Registering names to measure them]]). |
| Squarcina et al., USENIX Security 2021 {[squarcina2021_subdomain]} | Subdomain takeover across the Tranco top 50k, and what a takeover grants inside the same site. The founding dangling-record paper, Liu et al. (CCS 2016) {[liu2016_dangling]}, was selected for this corpus but its PDF was never retrieved, so it is cited here from the authors' copy and not counted. |
| Akiwate et al., IMC 2020 {[akiwate2020_lame]} and IMC 2021 {[akiwate2021_risky]} | Delegations that point at nameserver domains anyone can register: nine years of zone files, lame delegations and sacrificial nameservers. |
| So et al., USENIX Security 2025 {[so2025_lost]} and Hortea et al., PoPETs 2026 {[hortea2026_dead]} | **Current** residual-trust work: expired domains that apps still contact, tracked through their expiry — the app-side residual-trust work since 2025. |
| Sommese et al., IMC 2024 {[sommese2024_darkdns]} and Lu et al., NDSS 2021 {[lu2021_whowas]} | The two instruments papers: what daily zone snapshots miss, and what the GDPR did to WHOIS. Read both before you promise a registration count or a registrant. |

===== Four families, one pipeline =====

Every paper in this population measures names whose trust comes from somewhere other than their current holder. The four families differ in //where the trust comes from//, and that decides where you find instances:

^ Family ^ Why the name attracts traffic or trust ^ Where instances come from ^ What you then verify ^
| **Lookalike** | a person or machine makes an error against a //live// name: typo, bit flip, confusable character, brand plus keyword, a sentence parsed as a URL | a generator over a target list, matched against zone files, passive DNS or CT | registered? by whom? what does it serve? |
| **Parking** | the name is monetised rather than used; often the end state of the other three | parking-service nameservers in zone or DNS data | parked or not (a classifier), and where the ad or redirect chain leads |
| **Residual** | the name used to be something, or is referenced as if it were: expired, dropped, taken down and released, queried but never registered, embedded in an app or a link | drop lists, zone diffs, NXDOMAIN traffic, app traffic, link corpora | available? re-registered? what still arrives? |
| **Dangling** | a record or delegation points at something its owner no longer controls: a deprovisioned cloud resource, a released IP, an expired or typoed nameserver domain, a hosting zone anyone can create | zone files, subdomain enumeration, resolver and provider scans | claimable? claimed by someone already? |

**Where the families stop.** A lookalike that serves a credential form is a phish; the feed, cloaking and takedown questions are [[Security:Phishing]]. A lookalike that sells a fake product is [[Security:Online scams]]. A squat in the npm registry or an app store is the same idea in a different namespace, with its own registry rules; the papers are listed as context. Domain-generation-algorithm and generic malicious-domain detection are not here either — they classify names by behaviour, not by where their trust comes from — and no page on this wiki covers them yet; the eight such papers met here are counted as context.

===== Candidate generation: the generator is the population =====

A lookalike study starts from a //target list// (whose names are being imitated) and a //generator// (how imitations are produced). Both are sampling decisions, and a paper that states neither has an undefined population.

**The models.** Almost everything published uses some subset of these, often combined:

  * **Keyboard and edit-distance typos** — omission, insertion, substitution by adjacent key, transposition, repetition, missing dot. The canonical set comes from Wang et al.'s Strider Typo-Patrol (SRUTI 2006, outside the corpus); 24 corpus papers mention Typo-Patrol by name, 14 of them in this population. Agten et al. used five models at Damerau–Levenshtein distance 1 and explicitly exclude wrong TLDs and multiple typos {[agten2015_seven]}; Szurdi et al. estimated that about **20%** of the whole ''.com'' zone are true typo domains, and that only **6.8%** of registered typo domains target the 10,000 most popular ''.com'' names — the long tail is where they are {[szurdi2014_taile]}.
  * **Combosquatting** — the trademark plus added tokens (''paypal-login''). Not an edit-distance model at all, which is why typo generators miss it; Kintis et al. is the reference {[kintis2017_hiding]}.
  * **Bitsquatting** — one flipped bit. Nikiforakis et al. found **5,366** bitsquatting domains targeting **491** of the Alexa top 500 over 270 days, **71.8%** of which are not also typosquats {[nikiforakis2013_bitsquatting]}. A real but small population.
  * **Homographs** — confusable characters, mostly via IDN. ShamFinder combined Unicode's confusables list with its own automatically built homoglyph database, SimChar {[suzuki2019_shamfinder]}; Hu et al. found **1,855** homograph IDNs impersonating **674** popular names in ''.com'', of which Chrome showed Punycode for 64.1% and Safari and Firefox for 9.7% and 6.1% {[hu2021_idn]}. The current confusables data is Unicode Technical Standard #39, version 18.0.0.((''https://www.unicode.org/Public/security/latest/confusables.txt'', header "Version: 18.0.0" — checked 2026-09-25.)) Chromium's IDN policy compares the //skeleton// of a hostname against top domains and shows Punycode on a match((Chromium ''docs/idn.md'', step "If the skeleton of the registrable part of a hostname is identical to one of the top domains…" — ''https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md'', checked 2026-09-25.)) — so a homograph count says nothing about what a Chrome user sees; a measurement of exposure has to test the browser, as Hu et al. did.
  * **Soundsquatting** (homophones) and **user-error names** that are not typos of any target — a missing space after a full stop turning ''G-20. In'' into the link ''g-20.in'': Kaleli et al. collected **26,596** such unintended URLs from Twitter in seven months {[kaleli2021_human]}. Soundsquatting's defining paper is outside the seven venues.((Nikiforakis et al., //Soundsquatting: Uncovering the Use of Homophones in Domain Squatting//, ISC 2014, doi:10.1007/978-3-319-13257-0_17.))

**The target list.** Nine of the fourteen lookalike papers used a top list or a company list as targets. Seven of the nine stopped at the Alexa top 10K or a few hundred brands — the Alexa top 500 {[agten2015_seven]} {[nikiforakis2013_bitsquatting]}, top 10K {[suzuki2019_shamfinder]} {[hu2021_idn]}, the Fortune 500 {[adjibi2025_guardians]} — while Szurdi et al. split the top million into head, middle and tail {[szurdi2014_taile]} and Roberts et al. went to the top 100K {[roberts2019_impersonation]}. Alexa is gone; if you replace it, say with what and which day, because the long-tail result above means a head-only target list under-samples where most typo registrations are. See [[Design:Website selection]] and [[Programming:Tranco]].

**Tools, and their state today.** Most papers wrote their own generator. The named tools:

^ Tool ^ What it generates ^ Checks registration? ^ State on 2026-09-25 ^
| dnstwist | 16 fuzzers: addition, bitsquatting, cyrillic, homoglyph, hyphenation, insertion, omission, plural, repetition, replacement, subdomain, transposition, vowel-swap, dictionary, tld-swap, various | DNS (NS/A/AAAA/MX), WHOIS, GeoIP, HTTP/SMTP banners, fuzzy page hashes (ssdeep, TLSH), screenshot perceptual hash | maintained; latest release ''20250130'', last commit 2025-04-15; Apache-2.0 |
| URLCrazy | 17 variant types incl. homophones, bit flips, homoglyphs, wrong TLD | DNS only; its README: "This tool does not check if a domain has been registered" | latest release ''v0.8.2'' (2025-07-28); bespoke licence, not open-source |
| twistrs | a Rust port of dnstwist's permutation engine | library | active (pushed 2026-09-25); moved to ''haveibeensquatted/twistrs'' |
| ail-typo-squatting (CIRCL) | permutation library feeding AIL | — | last release ''v2.7.4'' (2023-12-01), commits to 2025-04-30 |

dnstwist is named in **5** corpus papers (3 in this population, 2018–2025), URLCrazy in **3**. Tian et al. used both, plus their own squatting rules, to scan 224 million DNS records {[tian2018_needle]}. If you use a tool, pin the release and publish the fuzzer list you enabled: the fuzzer set //is// your population definition. Repository states are re-checked by ''external_checks_domain_abuse.sh'' on [[provenance:security:domain_abuse]].

**LLMs.** No paper in this population uses an LLM to classify or generate names (0 of 48 in the extraction's classification records; one 2026 paper uses GPT-4o only to clean addresses in dispute records {[adjibi2026_udrp]}). Corpus-wide, papers with an LLM classification step went from 2 of 719 in 2023 to 77 of 770 in 2025. Outside the seven venues, DomainLynx uses an LLM pipeline for squatting detection (IEEE Access 2025).((Chiba, Nakano and Koide, //DomainLynx: Leveraging Large Language Models for Enhanced Domain Squatting Detection//, arXiv:2410.02095 (IEEE CCNC 2025); the extended version is //DomainLynx: Advancing LLM Techniques for Robust Domain Squatting Detection//, IEEE Access, doi:10.1109/ACCESS.2025.3542036. Not in the corpus and not counted.)) A related new residual-trust vector — names that code-generating models hallucinate and attackers then register — has, in peer-reviewed work, so far been measured for //package// names, not domains, and the one corpus-venue paper on it was screened out of this corpus.

===== Where registrations come from, and what each source misses =====

Once you have candidates you need to know which exist. Every source is a partial view, and the part it misses is systematic:

^ Source ^ What it sees ^ What it misses ^ Papers here (of 48) ^
| **TLD zone files** — ICANN CZDS for gTLDs, including ''.com''/''.net'' | every delegated second-level name in the TLD, daily | names with no nameservers, and names in ''serverHold'', ''clientHold'', ''pendingDelete'' or ''redemptionPeriod'' ((Verisign, //Top-Level Domain Zone File Data//, ''https://www.verisign.com/resources/zone-file/'': "The TLD zone files do not contain domain names in the following states: serverHold, clientHold, pendingDelete, and redemptionPeriod. In addition, they do not contain domain names that are not associated with name servers." The same page directs requests for the ''.com'', ''.net'' and ''.name'' zones to CZDS. Fetched 2026-09-25.)); names created and removed between two snapshots; almost all ccTLDs; subdomains | **20** (hand-coded) |
| **Certificate Transparency** | names (and subdomains) that got a publicly logged certificate | names that never got one; see [[Security:TLS certificates]] for the log-list and static-CT change | 6 |
| **Passive DNS** (Farsight/DNSDB, ISP resolvers) | names someone actually looked up, with first/last-seen dates | names nobody queried at the vendor's sensors; coverage is the vendor's customer base | 11 |
| **Active DNS datasets** (Active DNS Project, OpenINTEL) or your own resolution | resolution of a seeded list | only what is seeded | 11 |
| **Drop and pending-delete lists** | names about to be deleted | what happens at private auctions and registrar-internal transfers | 5 |
| **Traffic you can see** (ISP, enterprise proxy, root-server query captures, an email provider's bounces) | real demand for a name, including names that do not exist | only your vantage's users | 4 |
| **App code and app traffic** | names software will contact, even years later | apps you did not run | 4 (all 2023–2026) |

**Short-lived names are invisible to daily snapshots.** Sommese et al. found that "the daily snapshots miss at least 1% of newly registered and short-lived domains, which are frequently registered with likely malicious intent", and against a ccTLD registry's ground truth detected only a third of transient domains with the best public data {[sommese2024_darkdns]}. If your question involves abuse, the snapshot's blind spot is correlated with your label.

**ccTLDs are mostly dark.** A handful publish their full zone: ''.se'' and ''.nu'' (hourly, from ''zonedata.iis.se''), ''.ee'' (AXFR, CC BY 4.0), and ''.ch''/''.li'' through SWITCH's open-data portal.((Internetstiftelsen, //Access to zone files for .se and .nu//; Estonian Internet Foundation, //.ee zone file// ("downloadable based on the AXFR protocol"); SWITCH open data portal. All fetched 2026-09-25.)) Elsewhere you are inferring from CT, passive DNS or crawls, and the coverage of that inference is itself unknown. Akiwate et al.'s lame-delegation study leans on exactly such open ccTLD zones alongside the gTLD ones {[akiwate2020_lame]}.

The DNS-side instruments — CZDS, OpenINTEL, passive DNS — and their paper counts across the whole corpus are also tabulated on [[Design:DNS#Pick the instrument]]; this page counts only the 48.

**Newly registered domain feeds** are commercial derivatives of zone diffs and passive DNS; WhoisXML API advertises "around 450,000 newly registered or newly discovered domains" a day.((''https://newly-registered-domains.whoisxmlapi.com/'', fetched 2026-09-25. A vendor's own description, not an audited coverage figure.)) They inherit the snapshot gap above. For research access, Farsight (now DomainTools) runs a grant programme covering DNSDB and its newly-observed-domains feed, and OpenINTEL's open data is CC BY-NC-SA 4.0 with a required attribution.((DomainTools, //A Quick Guide to Farsight's Grant Program//; OpenINTEL, //Open Access Data — Terms of Use//. Both fetched 2026-09-25.))

In the extraction's own source fields, **21** corpus papers name CZDS — 16 of them since 2023 — and **3** name RDAP. Zone data went from a registry favour to routine infrastructure; registration data went the other way.

===== WHOIS after the GDPR, and RDAP =====

The registration record used to answer three questions: when was the name created and when does it expire, who is the registrar, and who is the registrant. Since 2018 only the first two are reliably public for gTLDs.

  * **May 2018:** registrars and registries began redacting registrant data under the GDPR. Lu et al. analysed 1.2 billion WHOIS records and found "over 85% surveyed large WHOIS providers redacting EEA records at scale" and "over 60% large WHOIS data providers also redact non-EEA records" {[lu2021_whowas]}.
  * **28 January 2025:** for ICANN-contracted gTLDs, "the Registration Data Access Protocol (RDAP) will be the definitive source … in place of sunsetted WHOIS services".((ICANN, //Launching RDAP; Sunsetting WHOIS//, 27 January 2025, ''https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en'' — fetched 2026-09-25.)) Port-43 WHOIS is no longer a contractual obligation; a WHOIS client in your pipeline is now a compatibility layer over whatever each operator still runs.
  * **21 August 2025:** ICANN's Registration Data Policy took effect, replacing the interim policy; where it applies, registrant name, street, postal code, phone and fax, and registrant and tech email are redacted from public output.((ICANN, //Registration Data Policy Now In Effect for Contracted Parties//, 21 August 2025; policy text §§9.2.2.1–9.2.2.2. Redaction is conditional on §9.2.1, not an unconditional rule. Fetched 2026-09-25.)) Non-public data is requested through ICANN's Registration Data Request Service (RDRS), launched in November 2023 as a pilot and extended in November 2025 "for up to two years past the project's initial pilot period".((ICANN blog, 20 November 2025, ''https://www.icann.org/en/blogs/details/rdrs-extended-as-icann-seeks-community-input-on-next-steps-20-11-2025-en'' — fetched 2026-09-25.)) It is meant for "law enforcement, intellectual property professionals, consumer protection advocates, cybersecurity professionals, and government officials", not for bulk research.((ICANN, //Launching RDAP; Sunsetting WHOIS//, 27 January 2025 — the same announcement as above; fetched 2026-09-25.))
  * **EU:** NIS2 Article 28 requires TLD registries and registrars to keep accurate registration data and to "make publicly available … the domain name registration data which are not personal data"; transposition was due by 17 October 2024.((Directive (EU) 2022/2555, Articles 28(4) and 41(1), CELEX 32022L2555 — fetched 2026-09-25.))

What this does to a measurement:

  * **Lifecycle studies are fine.** Creation, expiry and update dates, status codes and registrar are still published, and RDAP returns them as JSON instead of per-registrar free text — the parsing problem that needed a learned parser at ''.com'' scale in 2015 {[liu2015_whois]} largely goes away. Only one paper in this population used RDAP, in 2018, against Verisign's test deployment, falling back to WHOIS when a registrar's RDAP returned HTTP 500 {[lauinger2018_deletion]}.
  * **Registrant clustering is broken for new data.** "Who owns these 500 squats?" and "is this the brand's own registration?" used to be a WHOIS join. Now it needs other evidence: nameservers, registrar, redirect to the brand, a certificate shared with the brand, or a historical WHOIS product for pre-2018 records. Adjibi et al.'s defensive-registration rule combines several of these {[adjibi2025_guardians]}; [[Design:Ownership resolution]] covers what a registrant field was ever worth.
  * **Bulk lookups have terms.** Registry and registrar WHOIS and RDAP services limit automated high-volume querying in their terms of use; the constraint and a registry's wording are on [[Practices:Ethics#Terms of service and acceptable-use policies]]. Plan a lookup budget per day before you plan a population.
  * **Historical WHOIS is a commercial product with unknown sampling.** Ten papers here used one, four of them in 2025–2026. Lauinger et al. rejected such archives for a systematic study because "the companies do not disclose when and how they collect the data" {[lauinger2016_whois]}. If you use one, say which, and treat its gaps as missing data rather than as absence.
  * **ICANN's "DNS abuse" does not include squatting.** The 2024 contract amendments define DNS Abuse as "malware, botnets, phishing, pharming, and spam (when spam serves as a delivery mechanism for the other forms of DNS Abuse …)".((ICANN, //2024 Global Amendment to Registry Agreements//, effective 5 April 2024, Specification 6 §4.1 — fetched 2026-09-25.)) A typosquat that parks ads is a trademark matter, handled through UDRP disputes — WIPO managed "over 6,200 domain name cases" in 2025, its highest on record.((WIPO, ''https://www.wipo.int/amc/en/domains/news/2026/news_0001.html'' — fetched 2026-09-25.)) Adjibi et al. analysed **90,153** English-language UDRP proceedings and found that "2,751 malicious domains remained under malicious actors' control for up to four months after a panel ordered their transfer" {[adjibi2026_udrp]}. Do not describe your squats as "DNS abuse" in a paper a registrar will read; they will reply that it is not.

===== What does a squatted or re-registered name do? =====

Thirty of the 48 papers classify what the names they found actually do. This page codes their labels into a dozen classes — parked with ads, for sale, redirect to the target, redirect elsewhere, affiliate abuse, malicious, phishing, own content, error, unused — although the papers' own taxonomies differ. Across all 48, the labelling step, whatever it labels, is mostly **rules plus a manual pass**: rules in 36, manual review in 32, a trained classifier in 7.

What the papers found the names doing, with their own denominators:

^ Paper ^ Population ^ What the names did ^
| {[agten2015_seven]} | 28,179 generated typo domains of the Alexa top 500, 17,172 of which ever resolved | **477** of the 500 targets had at least one malicious typosquatting domain; 344 (68.8%) had no defensive registration at all |
| {[halvorson2015_academy]} | 3,638,209 domains in the new gTLD zones (2015) | **31.9%** parked; only **15%** "consistent with primary registrations"; the rest promotional, speculative or defensive |
| {[vissers2015_parking]} | more than 8 million parked domains at 15 parking services | 60% at three services; **131,673 (1.63%)** of them typosquatting |
| {[alrwais2014_parking]} | 24M visits to over 100K parked domains | 1.2M (5%) of visits produced redirection chains rather than a plain ad page; illicit monetisation was at least 0.8% of one reputable service's revenue and 40.3% of another's |
| {[miramirkhani2018_panning]} | re-registered dropped domains (1,059,050 caught in 80 days), a crawled subset labelled | less than 11% hosted web content; the rest were used by speculators or malicious actors |
| {[tian2018_needle]} | 657,663 squatting domains of 702 brands | **1,175** confirmed phishing pages; more than 90% evaded popular blacklists for at least a month |
| {[khan2015_every]} | 11.1K adversarial typo domains seen in enterprise and ISP traffic | 33 listed on VirusTotal (3 or more detections), 9 on Google Safe Browsing |

Three things follow for your design:

  * **Parking is a common outcome, so a parking detector is part of any squatting pipeline** — 31.9% of all new-gTLD registrations in 2015 were parked {[halvorson2015_academy]}. Vissers et al.'s Random Forest over HTML, HAR, frame and domain features is the published baseline {[vissers2015_parking]}; nuclei's takeover template set includes a parked-page signature (GoDaddy's) alongside its takeover fingerprints.((''projectdiscovery/nuclei-templates'', directory ''http/takeovers/'', 73 templates, one of them ''godaddy-parked-domain.yaml'' — listed via the GitHub API on 2026-09-25.)) No paper in these venues has made parking its subject since 2015.
  * **Blocklists see a sliver.** The coverage figures above (and the phishing-feed ones on [[Security:Phishing#What a blocklist hit proves]]) mean a blocklist can label a squat malicious but cannot tell you a squat is benign. VirusTotal as a label is [[Security:VirusTotal]].
  * **A use label is a snapshot.** Over seven months Agten et al. counted on average 2.84 category transitions per typosquatting domain {[agten2015_seven]}. One crawl gives you the label on that day; say which day, or re-crawl.
  * **Separate defensive registrations explicitly, or say you did not.** Only **8** of the 30 classifying papers have a defensive class. A redirect to the brand is not proof of ownership — Kintis et al. and Agten et al. both found affiliate abusers who redirect to the target with their affiliate ID appended {[kintis2017_hiding]} {[agten2015_seven]}. Check the redirect for affiliate parameters and the registration for the brand's nameservers or registrar before calling it defensive.

**Parked pages reach other people's crawls, too.** Among the 1,120 corpus papers that crawled, 50 mention parked domains at least once (a full-text mention, not read per paper), and 38 of those are not in this population — among them censorship-list and dead-link studies, privacy-policy corpora and notification campaigns, several of which filter parked pages as a cleaning step. That is the point: a parked page answers 200 and looks like a site, and a list-driven crawl that does not filter it counts ad-network templates as websites.

===== Expired domains and residual trust =====

A gTLD domain that is not renewed passes through an optional auto-renew grace period of 1–45 days, a 30-day Redemption Grace Period, and five days of pending delete before it is released.((ICANN, //Expired Registration Recovery Policy// (registrant FAQ) and ''.com'' Registry Agreement Appendix 7 §3.3.2 ("The current length of this Pending Delete Period is five calendar days") — both fetched 2026-09-25.)) Then it is caught or it is not:

  * **Drop-catching is fast and concentrated.** "10 % of all com domains are re-registered on the same day as their old registration is deleted"; drop-catch services "control over 75 % of accredited domain registrars and cause more than 80 % of domain creation attempts, but represent at most 9.5 % of successful domain creations" {[lauinger2017_game]}. On average only about 10% of dropped domains are caught {[miramirkhani2018_panning]}. The ''.com'' Drop starts at 19:00 UTC and many names are re-registered with zero delay {[lauinger2018_deletion]}, so any re-registration timing needs second-level resolution and the registry's own drop data, not daily WHOIS.
  * **What the new holder inherits.** Lever et al. found **27,758** blacklisted and **238,279** malware-resolved domains that had expired and been maliciously re-registered {[lever2016_domainz]}. Alowaisheq et al. found that **350K (56.46%)** of six years of taken-down domains had been released, and that expired //sinkhole// nameserver domains had handed about 30K seized domains to new owners {[alowaisheq2019_cracking]}. Ma et al. found valid TLS certificates held by a domain's previous owner — "over 9 million instances of abusable third-party stale certificates from 2016-2023 across 4.5 million effective second-level domains" {[ma2023_stale]}.
  * **Names that were never registered have residual demand too.** NXDOMAIN traffic: Liu et al. identified 146,363,745,785 NXDomains queried in passive DNS from 2014–2022 and registered 19 that had kept receiving queries while non-existent for at least six months {[liu2023_dial]}. Name collisions: leaked internal queries for strings that later became new gTLDs — **65.7%** of the new gTLDs delegated by August 2015 had leaked WPAD queries at two root servers before delegation {[chen2016_mitm]}. Links: Saric et al. found active links to "more than 572 000 dot-com domains that have never been registered" in Common Crawl {[saric2024_hyperlink]}.
  * **Software keeps calling dead names.** So et al.: **309** versions of **149** apps relied on **41** first-order domains that were immediately registrable {[so2025_lost]}; Hortea et al. tracked 3,420 domains used by 11,131 apps through their expiry and found **218** dangling CNAMEs susceptible to hijacking {[hortea2026_dead]}. The same check appears as one section of papers on IoT companion apps {[schmidt2023_iotflow]}, Deno packages {[alhamdan2025_deno]} and email auto-configuration {[wen2025_automatic]} — five of the population's eight section-level papers are residual-trust sections from 2023–2025. On this corpus's thin 2025–2026 years, this is where the residual-trust family shows new work.

**Measuring residual traffic without registering.** Randall et al.'s Trufflehunter estimates how many users look up rare names — typosquats among its case studies — by cache-snooping large public resolvers {[randall2020_trufflehunter]}. It gives a lower bound on demand without ever receiving anyone's traffic. If your question is "how much demand does this name have", try this before buying the name.

===== Dangling DNS and subdomain takeover =====

A dangling record points at a resource its owner released: a ''CNAME'' to a deleted cloud app or bucket, an ''A'' record to a released cloud IP, an ''NS'' record to a nameserver domain that expired or was renamed. Whoever claims the resource next answers for the name.((Microsoft's definition, current Azure guidance: "A subdomain takeover can occur when you have a DNS record that points to a deprovisioned Azure resource. Such DNS records are also known as 'dangling DNS' entries." ''https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover'', page dated 2026-07-20, fetched 2026-09-25.)) The literature has moved up the delegation chain:

^ Level ^ Papers ^ Measured ^
| Subdomain → third-party service | {[liu2016_dangling]} (not in the extraction), {[squarcina2021_subdomain]} | Squarcina et al.: **1,520** subdomains exposed to takeover on **887** of the Tranco top 50k domains, 83% from discontinued third-party services and 17% from expired domains; plus 13,532 potentially vulnerable domains through deprovisioned cloud instances |
| Record → released cloud IP | {[pauley2022_ipreuse]} | allocated 1.5 million unique AWS IPs (about 56% of the pool) over 101 days for $2,089.76; 14 top-million domains had dangling records at the second level |
| Delegation → registrable nameserver domain | {[kalafut2010_orphan]}, {[akiwate2020_lame]}, {[akiwate2021_risky]}, {[vissers2017_wolf]} (not in the extraction) | about 14% of 49 million actively measured domains had at least one lame delegation; of the 48,185 unresolvable nameserver domains behind 151,422 lame-delegated domains, 42,579 (88%) were available for purchase {[akiwate2020_lame]} |
| Delegation → shared DNS hosting | {[alowaisheq2020_zombie]}, {[zhang2023_wolf]}, {[zhang2024_cross]} | **125,124** domains vulnerable across 12 hosting providers, 10 of which did nothing to stop customers claiming unauthorised zones {[zhang2024_cross]} |
| Registry → stale glue and deleted domains still delegated | {[zhang2024_glue]}, {[zhang2025_misty]} | **23.18%** of glue records stale; 193,558 directly exploitable, affecting 6,687,000 domains {[zhang2024_glue]}; 3.4K "relic" domains across registry back ends serving 812 TLDs {[zhang2025_misty]} |

Two measurement problems are specific to this family:

  * **You cannot confirm a takeover without taking over.** A fingerprint ("the bucket does not exist", "no such app") is a candidate; only claiming the resource proves it. Squarcina et al. created accounts on each service and tested bindings against //their own// domain, and "did not create any virtual machine or registered any service at cloud providers" for the cloud case {[squarcina2021_subdomain]}; Hortea et al. did not claim anything {[hortea2026_dead]}. Report fingerprint matches and confirmed claims as different numbers.
  * **Fingerprint lists age.** Services change their error pages and add ownership verification. The community list ''can-i-take-over-xyz'' was last pushed 2025-02-08; the last commit touching nuclei's takeover templates (2026-07-20) only re-signed them, so it says nothing about new coverage; dnsReaper's latest release is 2.0.3 (2025-10-06); subjack's v3.0.0 (2026-03-16) README now claims NS-delegation and stale-A detection as well as ''CNAME'' fingerprints.((Repository states via the GitHub API, 2026-09-25; command and output on [[provenance:security:domain_abuse]].)) Name the list and its date, and re-verify fingerprints on a sample.

===== Registering names to measure them =====

The defaults for whether to receive traffic, what to retain and answer, who reviews the protocol, and what happens to the name afterwards are now in [[practices:ethics#Registering or claiming names to receive misdirected traffic|Ethics: registering and claiming names]]. This section records the measurement choices those defaults draw on.

**15** of the 48 papers registered domains themselves — **535** domains across the 13 that state an exact count, from one (a lab testbed) to 201; the other two give only a lower bound — and **6** took control of third-party resources: a seized domain's nameserver slot, 1.5 million cloud IPs, other people's zones on DNS-hosting services. Of these 19, **2** report ethics approval (one explicitly IRB), **2** an exemption or not-human-subjects determination, **2** approval by a non-IRB body (university counsel; an industry partner's network department), **10** an ethics section with no review body, and **3** nothing.

^ Paper ^ Registered or claimed ^ What they collected, and what they did with it ^ Review, as stated ^
| {[szurdi2017_email]} | 76 typo domains of email providers, over seven months | millions of emails; sensitive strings removed by regular expression before storage, encrypted with a key kept elsewhere | IRB approved (the authors' and their sponsor's) |
| {[kaleli2021_human]} | 45 unintended-URL domains, registered within hours of the tweet | client IP addresses and request headers; results reported as visit counts | IRB: not human-subjects research |
| {[so2022_spots]} | 201 expired domains | 650,737,621 requests; a 404 page carrying bot traps and fingerprinting JavaScript; never engaged clients; the domains **expired back into the pool** afterwards | ethics section, no review body |
| {[liu2023_dial]} | 19 NXDomains, six months | 5,925,311 queries, passive only; personal data anonymised, then deleted before publication; the authors will **keep renewing** the domains | ethics appendix, no review body |
| {[saric2024_hyperlink]} | 51 phantom domains plus a control | web-server logs of a blank page; chose not to serve tracking JavaScript | "ethics approval" |
| {[li2024_bounce]} | 30 unregistered recipient domains | **nothing deployed**; the names were offered free of charge to the brand owner | no IRB at the institution; authorised by the partner |
| {[akiwate2021_risky]} | 5 sacrificial-nameserver domains | observed incoming queries "while being careful to never respond"; logs deleted; one defensive registration | IRB declined jurisdiction; university general counsel approved |
| {[pauley2022_ipreuse]} | 1.5 million cloud IPs, 101 days | unsolicited traffic, stored encrypted; disclosure through Amazon, then to affected organisations | IRB exemption |
| {[zhang2023_wolf]} | undelegated records for 30 domains on hosting providers, including top-100 sites | ''A'' → 127.0.0.1 and a ''TXT'' record naming the researchers; removed afterwards | ethics discussed |
| {[zhang2024_cross]} | inactive real domains claimed on hosting providers | a ''TXT'' record for under two minutes, then released; query logs checked for real users | Menlo Report cited, no review body |

And the explicit refusals, which are as instructive: Akiwate et al. would not defensively register thousands of at-risk nameserver domains because it "would raise its own ethical issues if we could" {[akiwate2020_lame]}; So et al. (2025) and Hortea et al. registered none of the expired domains they found {[so2025_lost]} {[hortea2026_dead]}.

The decisions, as the papers expose them:

  * **Do you need the traffic at all?** Several questions — is the name registrable, is it referenced, how much demand does it have — are answerable without receiving anything: registrability checks, passive DNS volumes, cache snooping {[randall2020_trufflehunter]}.
  * **What do you keep?** From counts only, through headers and URLs, to full email bodies. The content you receive belongs to people who made a mistake; minimise at collection, not at analysis.
  * **Do you answer?** Answering a query or an HTTP request can change what the sender does next (deliver mail, send credentials, cache a record). Most papers here answered nothing, or a blank page.
  * **What happens to the name afterwards?** The papers disagree here, and the residual-trust literature itself says why it matters: a domain you let lapse goes back to a market where about a tenth of dropped names are caught, often by the actors this page measures. Renewing indefinitely {[liu2023_dial]}, handing the name to the brand {[li2024_bounce]}, leaving the affected project to register it after disclosure {[alhamdan2025_deno]}, and letting it expire {[so2022_spots]} are all on record. State which you chose and why.
  * **Who reviewed it?** An IRB can say this is not human-subjects research — and then nobody reviews it (two exemptions and one declined jurisdiction among the 19). The counsel route {[akiwate2021_risky]} is a model when that happens.

===== Which methods are current =====

The corpus runs to 2026, but 2025–2026 are its thinnest and provisional years (CCS and IMC 2026 have not been held; IEEE S&P and TheWebConf 2026 are incompletely indexed). The population has **7** papers from 2025 and **2** from 2026. "Current" below means **used by a 2022–2026 paper in these seven venues**; a judgement about whether you //should// use a method is marked as one.

^ Method ^ Years in this population ^ Status ^ On what evidence ^
| Keyboard-typo generation over a head-of-list target set | 2014–2019, 2025 | **current**, but //judgement:// never alone | {[adjibi2025_guardians]} combines it with combo, bit, homoglyph and homophone models; typo-only misses the combosquatting population {[kintis2017_hiding]} and the long tail {[szurdi2014_taile]} |
| Combosquatting by trademark-token matching in DNS data | 2017–2019, 2025 | current | {[kintis2017_hiding]}, {[adjibi2025_guardians]} |
| Homograph detection via confusables / homoglyph databases | 2018–2021, 2025 | current; confusables data now UTS #39 v18.0.0 | {[suzuki2019_shamfinder]}, {[hu2021_idn]} |
| Bitsquatting | 2013, 2018, 2025 | current by the rule; //judgement:// niche, one component of combined generators | {[nikiforakis2013_bitsquatting]} |
| Parking detection as a research subject | 2014–2015 | **historical as a subject**; the classifiers survive as a pipeline step | no parking-focused paper since 2015 |
| Live WHOIS for registrant identity | 2014–2026 | current by the rule; **superseded on external evidence** for post-2018 registrant data (GDPR redaction); port-43 WHOIS no longer required for gTLDs since 2025-01-28 | {[lu2021_whowas]}; use RDAP for dates, status and registrar |
| RDAP | 2018 | //judgement:// the current instrument; 1 of 48 papers used it | {[lauinger2018_deletion]} |
| Historical WHOIS products | 2016–2025 | current, for pre-2018 history; sampling undisclosed | 4 of the 9 papers from 2025–2026 |
| Daily zone snapshots (CZDS) | 2010–2026 | current, with the transient-domain gap | {[sommese2024_darkdns]} |
| Drop / pending-delete lists | 2016–2022 | current for lifecycle work | {[lauinger2017_game]}, {[so2022_spots]} |
| Registering or claiming names and logging what arrives | 2017–2024 | current, and the most ethically exposed method here | {[szurdi2017_email]}, {[kaleli2021_human]}, {[so2022_spots]}, {[liu2023_dial]}, {[saric2024_hyperlink]} |
| Subdomain-takeover fingerprint scanning | 2016 (outside the extraction), 2021, 2025–2026 | current; fingerprint lists need dating | {[squarcina2021_subdomain]}, {[hortea2026_dead]} |
| Delegation-level hijack measurement (lame, sacrificial, stale glue, relic, hosting) | 2010, 2020–2025 | **current**; 7 papers since 2020 | {[akiwate2021_risky]}, {[zhang2024_glue]}, {[zhang2025_misty]} |
| Expired dependencies in apps and code | 2023–2026 | **current and growing**, often as one section of another paper | {[so2025_lost]}, {[hortea2026_dead]} |
| LLM-based squatting detection | none here | **emerging outside these venues** | 0 of 48; DomainLynx (IEEE Access 2025) |

The lookalike family has **no primary paper in these venues from 2022–2024**, and two since — defensive registration (2025) and UDRP disputes (2026) — while 14 context papers from 2018–2025 study squatting in packages, containers, apps, voice skills, social handles and blockchain names. The squatting //idea// is current. The two lookalike papers since 2021 both take the defender's side — defensive registration and disputes — and both sit in the provisional years; what that says about typosquatting of DNS names as a research subject, this corpus cannot tell (see [[#Open questions]]).

===== Use in publications =====

Everything below is a claim about **seven venues** — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, **5,859** extracted papers. DNS-OARC workshops, the APWG eCrime symposium, PAM, TMA, DIMVA, EuroS&P, ACSAC, RAID and AsiaCCS are absent, so a domain-abuse paper missing from these counts may simply be outside the corpus. See [[Literature:Corpus]]. 2025–2026 are provisional.

==== The inclusion rule, and its measured precision ====

Six probes — the 2026-09-22 gap-pass regex, a squatting-vocabulary probe, a lifecycle-and-delegation probe, a parking probe, a registration-data probe at a high threshold, and the extraction's own free-text fields — produce a **149**-paper candidate set. Each candidate was read against a rule written before the verdicts were counted:

  * **IN** — the measured objects include DNS names (registered domains, subdomains, or the records and delegations behind them) whose abuse comes from the name or its lifecycle, and the paper counts instances in the wild. A paper about something else is IN when one measured section reports such a count (//section//); a paper that only mentions the risk is not.
  * **CONTEXT** — squatting in a namespace that is not DNS; a lookalike only as the vehicle of phishing or scams; the registration system itself as the instrument; malicious-domain and DGA detection; hijacking through resolver or registrar-account attacks; search poisoning on misspellings; user studies of lookalike URLs.
  * **OUT** — homonyms (a //dangling// pointer, //homography// in computer vision, re-registering an //account//) or passing mentions.
  * **Two scope decisions.** Email typosquatting is IN: the object is a registered DNS name, only the protocol carrying the mistaken traffic differs {[szurdi2017_email]}. Container-registry and package typosquatting {[liu2022_container]} {[neupane2023_confusion]} and ENS drop-catching {[muzammil2024_panning]} are CONTEXT: different registries, with their own naming and expiry rules. A reader could reasonably move ENS in.

^ Verdict ^ Papers of 149 ^
| IN — this page's population | **48** (32.2%): 40 primary, 8 section |
| CONTEXT — other namespace 14, malicious-domain detection 8, lookalike as a vehicle 5, registration data 4, DNS attacks 4, a check without a count 3, search poisoning 2, user study 1 | 41 |
| OUT — passing mention 52, homonym 8 | 60 |

How well each probe finds the population:

^ Probe ^ Hits ^ IN ^ Precision ^ Recall of the 48 ^
| gap-pass regex, 5 or more hits | 90 | 38 | 42.2% | 79.2% |
| squatting vocabulary, 5 or more | 68 | 22 | 32.4% | 45.8% |
| lifecycle and delegation, 5 or more | 51 | 29 | 56.9% | 60.4% |
| parking, 5 or more | 21 | 10 | 47.6% | 20.8% |
| registration data, 30 or more | 45 | 20 | 44.4% | 41.7% |
| extraction free text | 67 | 36 | 53.7% | 75.0% |

The gap pass chose this page on **85** papers (47 web, 25 from 2024–2026). The regex re-runs to exactly those numbers on ''paper.norm.txt''; over whitespace-collapsed ''paper.cols.txt'' it hits 90. It misses **10** of the 48 — the name-collision and delegation-hijack papers, which use its terms fewer than five times, and half of the section-level papers. Of its 27 hits from 2024–2026, 11 are in the population; 8 mention the terms in passing, 4 are squatting in other namespaces and 4 are other context.

Three on-topic papers were **selected for the corpus but never retrieved** — their full-text directories are empty — and so are not counted anywhere on this page: //All Your DNS Records Point to Us// (CCS 2016) {[liu2016_dangling]}, //The Wolf of Name Street// (CCS 2017) {[vissers2017_wolf]}, and //Alias Equals Zone?// (USENIX Security 2026). The first two are cited above from the authors' copies.

==== When, where, and which family ====

^ Years ^ IN ^ Lookalike ^ Parking ^ Residual ^ Dangling ^
| 2010–2013 | 2 | 1 | 0 | 0 | 1 |
| 2014–2017 | 13 | 5 | 3 | 5 | 0 |
| 2018–2021 | 13 | 6 | 0 | 3 | 4 |
| 2022–2024 | 11 | 0 | 0 | 6 | 5 |
| 2025–2026* | 9 | 2 | 0 | 5 | 2 |

*provisional. Counts include section-level papers (8: one lookalike 2020, five residual 2023–2025, two dangling 2024–2025). By venue: IMC 15, NDSS 10, USENIX Security 9, CCS 5, IEEE S&P 5, TheWebConf 3, **PETS 1**. 24 of the 48 include the web platform and 18 ran a crawl by the corpus definition — much of this literature measures the DNS, not pages.

==== What the 48 papers did ====

Hand-coded from structured reading notes on each paper's full text; the codes and their quotes are on the provenance page. A paper can have several values.

^ Question ^ Answer, papers of 48 ^
| Generator | none, names came from records, traffic or apps 37; keyboard typos 8; homoglyphs 5; combosquatting 4; a named tool 4; bit flips 3; homophones 1; user-error names 1 |
| Name and registration sources | WHOIS 31; zone files 20; top list as targets 18; passive DNS 11; active DNS 11; web crawl or corpus 8; CT 6; threat feeds 6; drop lists 5; traffic logs 4; app code or traffic 4; registry data 3; RDAP 1 |
| WHOIS | live 25; historical product 10; RDAP 1; not used 17 |
| Labelling | rules 36; manual 32; blocklist or VirusTotal 13; trained classifier 7; vendor categoriser 6; LLM 0 |
| Registered or claimed names | **19** (registered 15, claimed third-party resources 6) |
| Notified someone | 24; no notification stated 12; nothing to notify 12 |
| Longitudinal | 35; one window 13 |
| Ethics review, as stated | ethics section without a review body 21; nothing 16; ethics approval 4; exemption or not-human-subjects determination 3; non-IRB body 3; not required 1 |
| Released code or data | public 14; promised 2; on request 2; none mentioned 30 |

Ethics statements changed with the decade: **12** of the 17 papers from 2015–2019 say nothing about ethics, against **1** of the 27 from 2020–2026. The review body did not follow: 18 of those 27 have an ethics section and no review.

==== Methodology and limitations of these figures ====

Every corpus number is a count of **papers**, from the 5,859-paper extraction, with its denominator named. The **48** is a hand verdict over a 149-paper candidate set; the report script exits if the candidates and the verdicts diverge in either direction. The method table is a hand coding of those 48 by the author of this page from structured reading notes written by four sub-agents with verbatim quotes, not double-coded; **84.7%** of the notes' quotes were located mechanically in the papers, most misses being column splices or the notes' own elisions. Treat single-paper differences as soft. The source-family counts in the sources table are hand-coded; the CZDS and RDAP counts in the paragraph under it come from the extraction's own source fields and are corpus-wide. Full-text probes read ''paper.cols.txt'' (4 of 5,859 papers have none). Per-paper figures on this page were checked against the papers' text, not the extraction's summaries. The probes, the verdict list with a reason per paper, the codes, the unedited report output and the external checks are on [[provenance:security:domain_abuse]]; corpus-wide caveats are on [[Literature:Corpus]].

===== What to report =====

  * **Target list and generator.** Which names you imitated (list, rank cut, date) and which permutation families you generated, with the tool and release or your own rules published. Say which families you did //not// generate.
  * **Registration source and its date.** Zone snapshot (which TLDs, which days), CT, passive DNS (vendor, window), and the sentence that says what that source cannot see — at least the transient-domain gap and the ccTLDs you could not cover.
  * **Registration data.** RDAP or WHOIS, live or historical (which product), and how many records were redacted or missing. Do not treat a redacted registrant as "unknown owner" in a defensive-registration rule.
  * **Registered is not abused.** Report the funnel: generated → registered → resolving → classified, with counts at each step and the parked, for-sale and defensive shares, not only the malicious one.
  * **How you labelled, and on how many by hand.** Rules, classifier, blocklist (which, queried when), and the manual sample with its agreement.
  * **For lifecycle work, the clock.** Timestamps at the resolution of the phenomenon (seconds for drop-catching), the registry's own deletion data if you have it, and right-censoring: what share was still live, or still unregistered, when you stopped.
  * **For dangling records, candidates versus confirmations.** Fingerprint matches and confirmed claims as separate numbers, with the fingerprint list and its date.
  * **Anything you registered or claimed.** How many names, for how long, what you collected, whether you answered, what happened to the names afterwards, and who reviewed it.

<WRAP todo>
**If you take one thing off this page into a measurement:** log, per candidate name, the generator family that produced it, the source and date that showed it registered, the RDAP status and registrar on that date, whether it resolves and what it serves (parked, redirect with or without an affiliate parameter, content, error), and the evidence for or against a defensive registration. Those columns let a later reader rebuild your population with a different generator, date your registration claim, and separate squats from the brand's own names.
</WRAP>

===== Open questions =====

  * **RDAP-era registrant evidence.** No paper in these venues has measured what fraction of defensive-registration or ownership inferences still work with post-2025 registration data. The 2018 redaction was measured {[lu2021_whowas]}; the 2025 policy and the WHOIS sunset have not been.
  * **ccTLD coverage.** Almost every lookalike count here is a gTLD count. How much squatting sits in ccTLDs with closed zones is unmeasured in this population.
  * **Typosquatting of DNS names since 2021.** No primary lookalike paper in 2022–2024, then a defensive-registration and a dispute study. Whether squatting volume fell, moved to other namespaces, or simply stopped being publishable, this corpus cannot say.
  * **LLM-hallucinated domains.** Measured for package names outside these venues; not yet for domain names in them.
  * **What happens to research-registered names.** None of the 48 follows up on the names an earlier study let expire.
  * **The review gap.** 18 of 27 papers since 2020 have an ethics section and no review body. Whether that is because boards declined or because nobody asked is not recorded.

===== Related pages =====

  * [[:Security]] — namespace outline.
  * [[Design:DNS]] — resolution measurement, resolvers, and DNS as an instrument.
  * [[Security:Phishing]] — what a lookalike is used for, feeds and cloaking.
  * [[Security:Online scams]] — fake shops and other scam sites, often on disposable names.
  * [[Security:TLS certificates]] — Certificate Transparency as a data source.
  * [[Design:Ownership resolution]] — what a registrant field can and cannot tell you.
  * [[Security:VirusTotal]] — what a "detected" label is.
  * [[Practices:Ethics]] and [[Practices:Notifying websites]] — review and disclosure.
  * [[Design:Website selection]] — target lists.

<bibtex bibliography></bibtex>

~~DISCUSSION~~