Time-Series Measurement of Parked Domain Names and Their Malicious Uses

• TOMATSURI Takayuki

  Waseda University

• CHIBA Daiki

  NTT Secure Platform Laboratories, NTT Corporation

• AKIYAMA Mitsuaki

  NTT Secure Platform Laboratories, NTT Corporation

• UCHIDA Masato

  Waseda University

抄録

On the Internet, there are lots of unused domain names that are not used for any actual services. Domain parking is a monetization mechanism for displaying online advertisements in such unused domain names. Some domain names used in cyber attacks are known to leverage domain parking services after the attack. However, the temporal relationships between domain parking services and malicious domain names have not been studied well. In this study, we investigated how malicious domain names using domain parking services change over time. We conducted a large-scale measurement study of more than 66.8 million domain names that have used domain parking services in the past 19 months. We reveal the existence of 3,964 domain names that have been malicious after using domain parking. We further identify what types of malicious activities (e.g., phishing and malware) such malicious domain names tend to be used for. We also reveal the existence of 3.02 million domain names that utilized multiple parking services simultaneously or while switching between them. Our study can contribute to the efficient analysis of malicious domain names using domain parking services.

収録刊行物

• IEICE Transactions on Communications

  IEICE Transactions on Communications E104.B (7), 770-780, 2021-07-01

  一般社団法人 電子情報通信学会

キーワード

• domain parking
• malicious domain names
• time-series measurement

詳細情報

• CRID: 1390851497213428096
• NII論文ID: 130008060115
• DOI: 10.1587/transcom.2020cqp0007
• ISSN: 17451345
• ISSN: 09168516
• Web Site: https://www.jstage.jst.go.jp/article/transcom/E104.B/7/E104.B_2020CQP0007/_pdf
• 本文言語コード: en
• データソース種別:
  • JaLC
  • Crossref
  • CiNii Articles
  • KAKEN
• 抄録ライセンスフラグ: 使用不可