{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,23]],"date-time":"2025-12-23T06:55:06Z","timestamp":1766472906719,"version":"3.48.0"},"reference-count":33,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T00:00:00Z","timestamp":1761523200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T00:00:00Z","timestamp":1761523200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,27]]},"DOI":"10.23919\/cnsm67658.2025.11297506","type":"proceedings-article","created":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T18:40:10Z","timestamp":1766428810000},"page":"1-7","source":"Crossref","is-referenced-by-count":0,"title":["Double-Edged Sword: An Empirical Study on the Contribution of Cloud Providers in Malicious Infrastructure"],"prefix":"10.23919","author":[{"given":"Sousan","family":"Tarahomi","sequence":"first","affiliation":[{"name":"University of Twente,Enschede,The Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Raffaele","family":"Sommese","sequence":"additional","affiliation":[{"name":"University of Twente,Enschede,The Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jeroen","family":"Linssen","sequence":"additional","affiliation":[{"name":"Saxion University of Applied Sciences,Enschede,The Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ralph","family":"Holz","sequence":"additional","affiliation":[{"name":"University of Twente,Enschede,The Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Anna","family":"Sperotto","sequence":"additional","affiliation":[{"name":"University of Twente,Enschede,The Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"AWS IPs"},{"key":"ref2","article-title":"Azure IPs"},{"key":"ref3","article-title":"DigitalOcean IPs"},{"key":"ref4","article-title":"Google IPs"},{"key":"ref5","article-title":"IP2Location"},{"year":"2009","key":"ref6","article-title":"AWS: Zeus Botnet Controller"},{"year":"2024","key":"ref7","article-title":"Cybercrime-tracker"},{"year":"2024","key":"ref8","article-title":"DigitalSide Repository"},{"year":"2024","key":"ref9","article-title":"Domain Blocklist (DBL)"},{"year":"2024","key":"ref10","article-title":"OpenPhish"},{"year":"2024","key":"ref11","article-title":"Oracle DynDNS Malware Feeds"},{"year":"2024","key":"ref12","article-title":"Oracle IPs"},{"year":"2024","key":"ref13","article-title":"PhishingArmy"},{"year":"2024","key":"ref14","article-title":"PhishTank"},{"year":"2024","key":"ref15","article-title":"QuidsUp"},{"year":"2024","key":"ref16","article-title":"Tolouse Blacklists"},{"year":"2024","key":"ref17","article-title":"VxVault"},{"year":"2025","key":"ref18","article-title":"Domain Name Statistics by TLD Type"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104182"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.32"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SysSec.2011.25"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978349"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP48549.2020.00045"},{"journal-title":"NSI Blog","article-title":"The State of Cloud Ransomware in 2024","year":"2024","key":"ref24"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3646547.3689021"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-44081-7_11"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CloudNet51028.2020.9335812"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/NetSoft57336.2023.10175501"},{"key":"ref29","first-page":"1","article-title":"Is a name enough? Detecting clouds using DNS pointer records","volume-title":"Proc. IEEE CNSM","author":"Tarahomi"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2016.2558918"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.23919\/CNSM62983.2024.10814438"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329834"},{"article-title":"Domain parking: Largely present, rarely considered!","volume-title":"Proc. TMA","author":"Zirngibl","key":"ref33"}],"event":{"name":"2025 21st International Conference on Network and Service Management (CNSM)","start":{"date-parts":[[2025,10,27]]},"location":"Bologna, Italy","end":{"date-parts":[[2025,10,31]]}},"container-title":["2025 21st International Conference on Network and Service Management (CNSM)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11297200\/11297407\/11297506.pdf?arnumber=11297506","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,23]],"date-time":"2025-12-23T06:51:23Z","timestamp":1766472683000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11297506\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,27]]},"references-count":33,"URL":"https:\/\/doi.org\/10.23919\/cnsm67658.2025.11297506","relation":{},"subject":[],"published":{"date-parts":[[2025,10,27]]}}}