Monitoring the initial DNS behavior of malicious domains

摘要: Attackers often use URLs to advertise scams or propagate malware. Because the reputation of a domain can be used identify malicious behavior, miscreants register these domains "just in time" before an attack. This paper explores DNS behavior attack domains, as identified by appearance spam trap, shortly after were registered. We explore behavioral properties from two perspectives: (1) infrastructure associated with domain, is observable resource records; and (2) lookup patterns networks who are looking up initially. Our analysis yields many findings that may ultimately useful for early detection domains. By monitoring we find about 55% scam occur attacks at least one day registration, suggesting potential discovery solely based on resolves those also there few regions IP address space host name servers other types only Malicious have records distributed more widely across space, they quickly looked variety different networks. set "tainted" ASes heavily bad records. The features observe evident any even takes place; ultimately, might serve basis DNS-based warning system attacks.