security Domain Name Lifetimes: Baseline and Threats

[Future Sensors]

Domain Name Lifetimes: Baseline and Threats

Antonia Affinito, Raffaele Sommese, Gautam Akiwate, Stefan Savage, KC Claffy, Geoffrey M. Voelker, Alessio Botta, Mattijs Jonker

Network Traffic Measurement and Analysis Conference (TMA Conference 2022)

Abstract

The domain name system (DNS) is a key component of the Internet. The DNS is essentially a hierarchical and distributed database that involves – and is operated by – many independent parties that fulfill various roles. Top-level domains such as .com and .co.uk are run by registries. Registrants can register domain names, usually through so-called registrars, but sometimes directly with the TLD registry.​

​

Domain names go through a well-defined lifecycle and names that are only short-lived in ways break expectation. In this paper, we study domain name lifetimes at scale and over a ten-year period.​

​

We focus on ten prominent TLDs and observe that under most, the vast majority of lifetimes (95%) last exactly the minimum registration term of one year. The exception to this is .com, which sees 40% of lifetimes renewed for at least one more year. We also identify lifetimes that are suspiciously short-lived (e.g., 80% under .xyz).​

​

Using blocklist data we confirm that about 25% are reportedly malicious and study indicators if names are taken down and how quickly.​

​

Finally, we empirically study malicious name registration campaigns and show that this involves registrars that offer bulk registration options.​

This work was supported in part by: the NWO-DHS MADDVIPR project (628.001.031/FA8750-19-2-0004); the EU H2020 CONCORDIA project (830927); MIUR through the “ICT for Health” project, Dipartimento di Eccellenza (2018-2022) “Ingegneria Elettrica e delle Tecnologie dell’Informazione”; Cisco Systems through the Sponsored Research Agreement “Research Project for Industry 4.0”; and support from the UCSD Center for Networked Systems.​

Read more (PDF)

https://www-cs.stanford.edu/~gakiwate/papers/tma22-domain_lifetime.pdf​