Despite an extensive anti-phishing ecosystem, phishing attacks continue to capitalize on
gaps in detection to reach a significant volume of daily victims. In this paper, we isolate and …

Online scan engines such as VirusTotal are heavily used by researchers to label malicious
URLs and files. Unfortunately, it is not well understood how the labels are generated and …

Miscreants abuse thousands of domain names every day by launching large-scale attacks
such as phishing or malware campaigns. While some domains are solely registered for …

International Domain Names (IDNs) may contain Unicode in addition to ASCII characters.
This enables attackers to replace one or even more characters of a well-known domain with …

Take-down operations aim to disrupt cybercrime involving malicious domains. In the past
decade, many successful take-down operations have been reported, including those against …

Phishing is one of the most common cyberattacks these days. Attackers constantly look for
new techniques to make their campaigns more lucrative by extending the lifespan of …

Ethereum Name Service (ENS) domains allow users to map human-readable names (such
as gold. eth) to their cryptocurrency addresses, simplifying cryptocurrency transactions. Like …

The current landscape of the core Internet technologies shows considerable centralisation
with the big tech companies controlling the vast majority of traffic and services. This situation …

Certificate authorities enable TLS server authentication by generating certificates that attest
to the map** between a domain name and a cryptographic keypair, for up to 398 days …

VirusTotal (VT) is a widely used scanning service for researchers and practitioners to label
malicious entities and predict new security threats. Unfortunately, it is little known to the end …