{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,21]],"date-time":"2025-09-21T17:16:46Z","timestamp":1758475006676,"version":"3.44.0"},"publisher-location":"New York, NY, USA","reference-count":72,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,10,24]],"date-time":"2023-10-24T00:00:00Z","timestamp":1698105600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62102218"],"award-info":[{"award-number":["62102218"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"National Key R&D Program of China","award":["2021YFB3100500"],"award-info":[{"award-number":["2021YFB3100500"]}]},{"name":"Tsinghua University-China Telecom Corp., Ltd. Joint Research Center for Next Generation Internet Technology Research Fund"},{"name":"CCF-Tencent Rhino-Bird Young Faculty Open Research Fund","award":["CCF-Tencent RAGR20230116"],"award-info":[{"award-number":["CCF-Tencent RAGR20230116"]}]},{"name":"Alibaba Innovative Research Program (AIR)"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,10,24]]},"DOI":"10.1145\/3618257.3624839","type":"proceedings-article","created":{"date-parts":[[2023,10,23]],"date-time":"2023-10-23T00:19:52Z","timestamp":1698020392000},"page":"188-197","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Wolf in Sheep's Clothing: Evaluating Security Risks of the Undelegated Record on DNS Hosting Services"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5325-175X","authenticated-orcid":false,"given":"Fenglu","family":"Zhang","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0878-7656","authenticated-orcid":false,"given":"Yunyi","family":"Zhang","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9032-8063","authenticated-orcid":false,"given":"Baojun","family":"Liu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1189-0164","authenticated-orcid":false,"given":"Eihal","family":"Alowaisheq","sequence":"additional","affiliation":[{"name":"King Saud University, Riyadh, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7445-9103","authenticated-orcid":false,"given":"Lingyun","family":"Ying","sequence":"additional","affiliation":[{"name":"QI-ANXIN Technology Research Institute, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7388-1329","authenticated-orcid":false,"given":"Xiang","family":"Li","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-4127-876X","authenticated-orcid":false,"given":"Zaifeng","family":"Zhang","sequence":"additional","affiliation":[{"name":"360 Security Technology Inc., Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4919-1130","authenticated-orcid":false,"given":"Ying","family":"Liu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0083-733X","authenticated-orcid":false,"given":"Haixin","family":"Duan","sequence":"additional","affiliation":[{"name":"Tsinghua University; Quancheng Laboratory, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6654-7610","authenticated-orcid":false,"given":"Min","family":"Zhang","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, China"}]}],"member":"320","published-online":{"date-parts":[[2023,10,24]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Akamai. 2023. Edge DNS-Secure DNS Solution and Edge Platform. https:\/\/www.akamai.com\/products\/edge-dns."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561425"},{"key":"e_1_3_2_1_3_1","unstructured":"Alibaba. 2023. Domain Name Service. https:\/\/www.alibabacloud.com\/domain."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417864"},{"key":"e_1_3_2_1_5_1","unstructured":"Amazon. 2023. Amazon Route 53|DNS Service. https:\/\/aws.amazon.com\/route53\/."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.5555\/1929820.1929844"},{"key":"e_1_3_2_1_7_1","unstructured":"Baidu. 2023. Baidu AI Cloud. https:\/\/intl.cloud.baidu.com\/."},{"key":"e_1_3_2_1_8_1","unstructured":"Nick Biasini and J Esler. 2015. Threat spotlight: Angler lurking in the domain shadows."},{"key":"e_1_3_2_1_9_1","volume-title":"EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis.","author":"Bilge Leyla","year":"2011","unstructured":"Leyla Bilge, Engin Kirda, Christopher Kruegel, and Marco Balduzzi. 2011. EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3232755.3232859"},{"key":"e_1_3_2_1_11_1","volume-title":"Padding Aintextquoterightt Enough: Assessing the Privacy Guarantees of Encrypted DNS. In 10th USENIX Workshop on Free and Open Communications on the Internet (FOCI 20)","author":"Bushart Jonas","year":"2020","unstructured":"Jonas Bushart and Christian Rossow. 2020. Padding Aintextquoterightt Enough: Assessing the Privacy Guarantees of Encrypted DNS. In 10th USENIX Workshop on Free and Open Communications on the Internet (FOCI 20). USENIX Association. https:\/\/www.usenix.org\/conference\/foci20\/presentation\/bushart"},{"key":"e_1_3_2_1_12_1","volume-title":"DEF CON: New tool brings back 'domain fronting' as 'domain hiding'. https:\/\/www.zdnet.com\/article\/def-con-new-tool-brings-back-domain-fronting-as-domain-hiding\/.","author":"Cimpanu Catalin","year":"2023","unstructured":"Catalin Cimpanu. 2023. DEF CON: New tool brings back 'domain fronting' as 'domain hiding'. https:\/\/www.zdnet.com\/article\/def-con-new-tool-brings-back-domain-fronting-as-domain-hiding\/."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2016.51"},{"key":"e_1_3_2_1_14_1","unstructured":"Cisco. 2023 a. Cisco Umbrella|Leader in Cloud Cybersecurity SASE Solutions. https:\/\/umbrella.cisco.com\/."},{"key":"e_1_3_2_1_15_1","unstructured":"Cisco. 2023 b. DNS-Layer Security: The Ultimate Guide to What It Is and Why You Need It. https:\/\/umbrella.cisco.com\/blog\/what-is-dns-layer-security."},{"key":"e_1_3_2_1_16_1","unstructured":"Cisco. 2023. Snort-Network Intrusion Detection & Prevention System. https:\/\/www.snort.org\/."},{"key":"e_1_3_2_1_17_1","unstructured":"Cloudflare. 2023. Cloudflare Inc. - Investor Relations. https:\/\/cloudflare.net\/home\/default.aspx."},{"key":"e_1_3_2_1_18_1","unstructured":"ClouDNS. 2023. Free DNS hosting Cloud DNS hosting and Domain names. https:\/\/www.cloudns.net\/."},{"key":"e_1_3_2_1_19_1","unstructured":"CSC. 2023. DNS Services | Managed DNS Security - CSC. https:\/\/www.cscdbs.com\/en\/domain-security\/dns-services\/."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","unstructured":"Viktor Dukhovni and Wes Hardaker. 2015. The DNS-Based Authentication of Named Entities (DANE) Protocol: Updates and Operational Guidance. RFC 7671. https:\/\/doi.org\/10.17487\/RFC7671","DOI":"10.17487\/RFC7671"},{"key":"e_1_3_2_1_21_1","unstructured":"Emercoin. 2022. EmerDNS - Blockchain Service. https:\/\/emercoin.com\/en\/emerdns\/."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.5555\/1855686.1855692"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1515\/popets-2015-0009"},{"key":"e_1_3_2_1_24_1","unstructured":"Mozilla Foundation. 2023. PUBLIC SUFFIX LIST. https:\/\/publicsuffix.org\/."},{"key":"e_1_3_2_1_25_1","unstructured":"Godaddy. 2023. Domain Names Websites and Hosting. https:\/\/sg.godaddy.com\/."},{"key":"e_1_3_2_1_26_1","unstructured":"Google. 2023 a. Google Scholar. https:\/\/scholar.google.com\/scholar'start=0&as_sdt=2005&sciodt=0 5&cites=1499698348405075976&scipsc= ."},{"key":"e_1_3_2_1_27_1","unstructured":"Google. 2023 b. Public DNS-Google for Developers. https:\/\/developers.google.com\/speed\/public-dns."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196514"},{"key":"e_1_3_2_1_29_1","volume-title":"On the DNS Deployment of Modern Web Services. In 2015 IEEE 23rd International Conference on Network Protocols (ICNP). IEEE, 100--110","author":"Hao Shuai","year":"2015","unstructured":"Shuai Hao, Haining Wang, Angelos Stavrou, and Evgenia Smirni. 2015. On the DNS Deployment of Modern Web Services. In 2015 IEEE 23rd International Conference on Network Protocols (ICNP). IEEE, 100--110."},{"key":"e_1_3_2_1_30_1","volume-title":"Measuring Chinatextquoterights DNS Censorship. In 30th USENIX Security Symposium (USENIX Security 21)","author":"Hoang Nguyen Phong","year":"2021","unstructured":"Nguyen Phong Hoang, Arian Akhavan Niaki, Jakub Dalek, Jeffrey Knockel, Pellaeon Lin, Bill Marczak, Masashi Crete-Nishihata, Phillipa Gill, and Michalis Polychronakis. 2021. How Great is the Great Firewall? Measuring Chinatextquoterights DNS Censorship. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 3381--3398. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/hoang"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","unstructured":"Paul E. Hoffman. 2023. DNS Security Extensions (DNSSEC). RFC 9364. https:\/\/doi.org\/10.17487\/RFC9364","DOI":"10.17487\/RFC9364"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC6698"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN53405.2022.00030"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3078428"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561434"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485384"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3423664"},{"key":"e_1_3_2_1_38_1","volume-title":"The Menlo Report: Ethical principles guiding information and communication technology research. Available at SSRN 2445102","author":"Kenneally Erin","year":"2012","unstructured":"Erin Kenneally and David Dittrich. 2012. The Menlo Report: Ethical principles guiding information and communication technology research. Available at SSRN 2445102 (2012)."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","unstructured":"Scott Kitterman. 2014. Sender Policy Framework (SPF) for Authorizing Use of Domains in Email Version 1. RFC 7208. https:\/\/doi.org\/10.17487\/RFC7208","DOI":"10.17487\/RFC7208"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Athanasios Kountouras Panagiotis Kintis Athanasios Avgetidis Thomas Papastergiou Charles Lever Michalis Polychronakis and Manos Antonakakis. 2021. Understanding the Growth and Security Considerations of ECS.. In NDSS.","DOI":"10.14722\/ndss.2021.24343"},{"volume-title":"Research in Attacks, Intrusions, and Defenses, Fabian Monrose, Marc Dacier, Gregory Blanc, and Joaquin Garcia-Alfaro (Eds.)","author":"Kountouras Athanasios","key":"e_1_3_2_1_41_1","unstructured":"Athanasios Kountouras, Panagiotis Kintis, Chaz Lever, Yizheng Chen, Yacin Nadji, David Dagon, Manos Antonakakis, and Rodney Joffe. 2016. Enabling Network Security Through Active DNS Datasets. In Research in Attacks, Intrusions, and Defenses, Fabian Monrose, Marc Dacier, Gregory Blanc, and Joaquin Garcia-Alfaro (Eds.). Springer International Publishing, Cham, 188--208."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","unstructured":"Murray Kucherawy Dave Crocker and Tony Hansen. 2011. DomainKeys Identified Mail (DKIM) Signatures. RFC 6376. https:\/\/doi.org\/10.17487\/RFC6376","DOI":"10.17487\/RFC6376"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815683"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN48987.2021.00025"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663747"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978387"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134049"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00076"},{"key":"e_1_3_2_1_49_1","unstructured":"MaxMind. 2023. IP Geolocation and Online Fraud Prevention|MaxMind. https:\/\/www.maxmind.com\/en\/home."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3423625"},{"volume-title":"Namecheap: Buy a domain name - Register cheap domain. https:\/\/www.namecheap.com\/.","year":"2023","key":"e_1_3_2_1_51_1","unstructured":"Namecheap. 2023. Namecheap: Buy a domain name - Register cheap domain. https:\/\/www.namecheap.com\/."},{"key":"e_1_3_2_1_52_1","unstructured":"Palo Alto Networks. 2023. Next-Generation Firewalls - Palo Alto Networks. https:\/\/www.paloaltonetworks.com\/network-security\/next-generation-firewall."},{"key":"e_1_3_2_1_53_1","volume-title":"Longitudinal Internet Censorship Measurement Platform. In 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 135--151","author":"Niaki Arian Akhavan","year":"2020","unstructured":"Arian Akhavan Niaki, Shinyoung Cho, Zachary Weinberg, Nguyen Phong Hoang, Abbas Razaghpanah, Nicolas Christin, and Phillipa Gill. 2020. ICLab: A Global, Longitudinal Internet Censorship Measurement Platform. In 2020 IEEE Symposium on Security and Privacy (SP). IEEE, 135--151."},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00049"},{"key":"e_1_3_2_1_55_1","unstructured":"OISF. 2023. Suricata-Home. https:\/\/suricata.io\/."},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/2896816"},{"key":"e_1_3_2_1_57_1","volume-title":"Global Measurement of DNS Manipulation. In 26th USENIX Security Symposium (USENIX Security 17)","author":"Pearce Paul","year":"2017","unstructured":"Paul Pearce, Ben Jones, Frank Li, Roya Ensafi, Nick Feamster, Nick Weaver, and Vern Paxson. 2017. Global Measurement of DNS Manipulation. In 26th USENIX Security Symposium (USENIX Security 17). USENIX Association, Vancouver, BC, 307--323. https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/pearce"},{"key":"e_1_3_2_1_58_1","unstructured":"Pieter Arntz. 2022. The pitfalls of blocking IP addresses. https:\/\/www.malwarebytes.com\/blog\/news\/2022\/12\/the-pitfalls-of-blocking-ip-addresses."},{"key":"e_1_3_2_1_59_1","unstructured":"QAX. 2023. ALPHA Threat Intelligence Platform. https:\/\/ti.qianxin.com\/."},{"key":"e_1_3_2_1_60_1","unstructured":"Radware. 2023. Dark.IoT Botnet. https:\/\/www.radware.com\/security\/threat-advisories-and-attack-reports\/dark-iot-botnet\/."},{"key":"e_1_3_2_1_61_1","unstructured":"Rob Shapland. 2022. How to defend against malicious IP addresses in the cloud. https:\/\/www.techtarget.com\/searchsecurity\/tip\/How-to-defend-against-malicious-IP-addresses-in-the-cloud."},{"key":"e_1_3_2_1_62_1","unstructured":"360 Security. 2023 a. 360 Threat Intelligence Platform. https:\/\/ti.360.net\/."},{"key":"e_1_3_2_1_63_1","unstructured":"360 Security. 2023 b. Ghost in action: the Specter botnet. https:\/\/blog.netlab.360.com\/ghost-in-action-the-specter-botnet\/."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417883"},{"key":"e_1_3_2_1_65_1","unstructured":"TechTerms. 2023. Trojan Horse Definition. https:\/\/techterms.com\/definition\/trojanhorse."},{"key":"e_1_3_2_1_66_1","unstructured":"Tencent. 2023. Tencent Cloud. https:\/\/intl.cloud.tencent.com\/?lang=en."},{"key":"e_1_3_2_1_67_1","volume-title":"Domain Borrowing: Catch My C2 Traffic if You Can. https:\/\/www.blackhat.com\/asia-21\/briefings\/schedule\/index.html#domain-borrowing-catch-my-c-traffic-if-you-can-22314","author":"Tianze Ding Junyu Zhou","year":"2021","unstructured":"Junyu Zhou Tianze Ding. 2021. Domain Borrowing: Catch My C2 Traffic if You Can. https:\/\/www.blackhat.com\/asia-21\/briefings\/schedule\/index.html#domain-borrowing-catch-my-c-traffic-if-you-can-22314"},{"key":"e_1_3_2_1_68_1","volume-title":"Gavin Li, Yael Eiger, and Roya Ensafi.","author":"Tsai Elisa","year":"2023","unstructured":"Elisa Tsai, Deepak Kumar, Ram Sundara Raman, Gavin Li, Yael Eiger, and Roya Ensafi. 2023. CERTainty: Detecting DNS Manipulation at Scale using TLS Certificates. arXiv preprint arXiv:2305.08189 (2023)."},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW51379.2020.00080"},{"key":"e_1_3_2_1_70_1","unstructured":"VirusTotal. 2023. VirusTotal - How it work. https:\/\/support.virustotal.com\/hc\/en-us\/articles\/115002126889-How-it-works."},{"key":"e_1_3_2_1_71_1","unstructured":"WordPress. 2023. WordPress.com: Build a Site Sell Your Stuff Start a Blog & More. https:\/\/wordpress.com\/."},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00021"}],"event":{"name":"IMC '23: ACM Internet Measurement Conference","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication"],"location":"Montreal QC Canada","acronym":"IMC '23"},"container-title":["Proceedings of the 2023 ACM on Internet Measurement Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3618257.3624839","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3618257.3624839","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T13:19:01Z","timestamp":1755868741000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3618257.3624839"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,24]]},"references-count":72,"alternative-id":["10.1145\/3618257.3624839","10.1145\/3618257"],"URL":"https:\/\/doi.org\/10.1145\/3618257.3624839","relation":{},"subject":[],"published":{"date-parts":[[2023,10,24]]},"assertion":[{"value":"2023-10-24","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}