{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T16:20:40Z","timestamp":1772727640111,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":60,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,12,12]],"date-time":"2023-12-12T00:00:00Z","timestamp":1702339200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,12,12]]},"DOI":"10.1145\/3630590.3630600","type":"proceedings-article","created":{"date-parts":[[2023,12,12]],"date-time":"2023-12-12T12:04:36Z","timestamp":1702382676000},"page":"78-86","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":4,"title":["Unraveling Threat Intelligence Through the Lens of Malicious URL Campaigns"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3846-6282","authenticated-orcid":false,"given":"Mahathir","family":"Almashor","sequence":"first","affiliation":[{"name":"CSIRO Energy, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8033-0998","authenticated-orcid":false,"given":"Ejaz","family":"Ahmed","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-0278-4215","authenticated-orcid":false,"given":"Benjamin","family":"Pick","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5411-5039","authenticated-orcid":false,"given":"Jason","family":"Xue","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9695-7947","authenticated-orcid":false,"given":"Sharif","family":"Abuadbba","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2499-2553","authenticated-orcid":false,"given":"Raj","family":"Gaire","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8938-2364","authenticated-orcid":false,"given":"Shuo","family":"Wang","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6353-8359","authenticated-orcid":false,"given":"Seyit","family":"Camtepe","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3289-6599","authenticated-orcid":false,"given":"Surya","family":"Nepal","sequence":"additional","affiliation":[{"name":"CSIRO Data61, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2023,12,12]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2966760"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2015.11.016"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3230833.3233280"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3313831.3376168"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3411764.3445574"},{"key":"e_1_3_2_1_6_1","unstructured":".au Domain Administration Ltd. 2021. About.au Domain Administration. https:\/\/www.auda.org.au\/about-auda\/about-au-domain-administration. Accessed 2021-05-24."},{"key":"e_1_3_2_1_7_1","volume-title":"Threat update: COVID-19 malicious cyber activity","author":"Directorate\u2019s Australian Cyber Security Australian Signals","year":"2020","unstructured":"Australian Signals Directorate\u2019s Australian Cyber Security Centre. 2021. Threat update: COVID-19 malicious cyber activity 20 April 2020. https:\/\/www.cyber.gov.au\/sites\/default\/files\/2020-04\/ACSC-Threat-Update-COVID-19-Malicious-Cyber-Activity-20200420.pdf. Accessed 2021-05-12."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3474718.3474723"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/3373017.3373020"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","unstructured":"Tim Berners-Lee Larry\u00a0M Masinter and Mark\u00a0P. McCahill. 1994. Uniform Resource Locators (URL). RFC 1738. https:\/\/doi.org\/10.17487\/RFC1738","DOI":"10.17487\/RFC1738"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2872427.2883056"},{"key":"e_1_3_2_1_12_1","volume-title":"DomainScouter: Understanding the Risks of Deceptive IDNs. In 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019","author":"Chiba Daiki","year":"2019","unstructured":"Daiki Chiba, Ayako\u00a0Akiyama Hasegawa, Takashi Koide, Yuta Sawabe, Shigeki Goto, and Mitsuaki Akiyama. 2019. DomainScouter: Understanding the Risks of Deceptive IDNs. In 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019). USENIX Association, Chaoyang District, Beijing, 413\u2013426. https:\/\/www.usenix.org\/conference\/raid2019\/presentation\/chiba"},{"key":"e_1_3_2_1_13_1","unstructured":"Cofense. 2022. SIEM Alerts | What is a SIEM Alert and How Does It Work?https:\/\/cofense.com\/what-is-a-siem-alert\/"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCNT49239.2020.9225338"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3419476"},{"key":"e_1_3_2_1_16_1","unstructured":"Federal Bureau of Investigation. 2021. Cyber Actors Exploit \u2019Secure\u2019 Websites In Phishing Campaigns. https:\/\/www.ic3.gov\/Media\/Y2019\/PSA190610. Accessed 2021-05-24."},{"key":"e_1_3_2_1_17_1","unstructured":"FireEye. 2022. What is SIEM and how does it work?https:\/\/www.fireeye.com\/products\/helix\/what-is-siem-and-how-does-it-work.html"},{"key":"e_1_3_2_1_18_1","unstructured":"Google. 2021. Google Safe Browsing. https:\/\/safebrowsing.google.com\/. Accessed: 2021-05-24."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243840"},{"key":"e_1_3_2_1_20_1","volume-title":"Proceedings of the 30th USENIX Security Symposium. USENIX, Online Only, 3739\u20133756","author":"Hu Hang","year":"2021","unstructured":"Hang Hu, Steve T.\u00a0K. Jan, Yang Wang, and Gang Wang. 2021. Assessing Browser-level Defense against {IDN-based} Phishing. In Proceedings of the 30th USENIX Security Symposium. USENIX, Online Only, 3739\u20133756. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/hu-hang"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2018.2871866"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3305268"},{"key":"e_1_3_2_1_23_1","unstructured":"JoeSandboxCloud. 2021. Analysis Report ubar-pro4[.]ru. https:\/\/www.joesandbox.com\/analysis\/229408\/0\/html. Accessed: 2021-05-31."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354239"},{"key":"e_1_3_2_1_25_1","volume-title":"\u00a0H. Hoi","author":"Le Hung","year":"2018","unstructured":"Hung Le, Quang Pham, Doyen Sahoo, and Steven C.\u00a0H. Hoi. 2018. URLNet: Learning a URL Representation with Deep Learning for Malicious URL Detection. arxiv:1802.03162\u00a0[cs.CR]"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.3"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.59"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23319"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2847671"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.11.004"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/1961189.1961202"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3423632"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3470024"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3178876.3186092"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359791"},{"key":"e_1_3_2_1_36_1","unstructured":"Sophos News. 2021. Nearly a quarter of malware now communicates using TLS. https:\/\/news.sophos.com\/en-us\/2020\/02\/18\/nearly-a-quarter-of-malware-now-communicates-using-tls\/. Accessed: 2021-05-31."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00049"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274710"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355585"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384765"},{"key":"e_1_3_2_1_41_1","volume-title":"Network and Distributed Systems Security (NDSS) Symposium","author":"Razaghpanah Abbas","year":"2018","unstructured":"Abbas Razaghpanah, Rishab Nithyanand, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Mark Allman, Christian Kreibich, and Phillipa Gill. 2018. Apps, trackers, privacy, and regulators: A global study of the mobile tracking ecosystem. In Network and Distributed System Security (NDSS). Network and Distributed Systems Security (NDSS) Symposium 2018, San Diego, CA, US, 1\u201315."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939918.2939937"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427233"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/3465361"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2991403"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278532.3278545"},{"key":"e_1_3_2_1_47_1","unstructured":"SGNIC. 2022. Singapore Network Information Center - List of Registrars. https:\/\/www.sgnic.sg\/domain-registration\/list-of-registrars."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243779"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2017.105"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243829"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/2967360.2967367"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663887.2663904"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/3131365.3131399"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278532.3278569"},{"key":"e_1_3_2_1_55_1","unstructured":"VirusTotal. 2022. VirusTotal: How it works. https:\/\/support.virustotal.com\/hc\/en-us\/articles\/115002126889-How-it-works"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663742"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/3191329"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3420013"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00039"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052609"}],"event":{"name":"AINTEC '23: Asian Internet Engineering Conference","location":"Hanoi Vietnam","acronym":"AINTEC '23"},"container-title":["Proceedings of the 18th Asian Internet Engineering Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3630590.3630600","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3630590.3630600","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T18:13:01Z","timestamp":1755972781000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3630590.3630600"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,12,12]]},"references-count":60,"alternative-id":["10.1145\/3630590.3630600","10.1145\/3630590"],"URL":"https:\/\/doi.org\/10.1145\/3630590.3630600","relation":{},"subject":[],"published":{"date-parts":[[2023,12,12]]},"assertion":[{"value":"2023-12-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}