Pith. sign in

REVIEW 4 major objections 5 minor 98 references

MANTIS: Detection of Zero-Day Malicious Domains Leveraging Low Reputed Hosting Infrastructure

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A system called MANTIS detects newly hosted malicious domains, before they serve any content, by tracking the hosting infrastructure that attackers reuse: it achieves 99.7% precision and 0.1% false positives while flagging roughly 19,000…

desk verdict Serious applied system paper worth refereeing, but the headline precision/FPR claims are not actually pinned by the paper's own sanity check: only 164/1000 domains were manually verified and the rest are scored malicious on signals the paper admits are inconclusive. read the letter →

arxiv 2502.09788 v1 pith:PLACG4VM submitted 2025-02-13 cs.CR

Fatih Deniz , Mohamed Nabeel , Ting Yu , Issa Khalil This is my paper · ORCID
classification cs.CR
keywords maliciousdomaindetectionpassiveDNSgraphneuralnetworkhostinginfrastructurereusezero-dayblocklistgenerationinductivelearningattackcampaigns
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that new attacker-created malicious domains can be detected at the moment they are hosted, before they serve content, by watching the hosting infrastructure they share with previously known malicious domains. The authors argue that because attackers automate and reuse IPs, the neighborhood of recently malicious IPs is far more toxic than the Internet at large, yet shared hosting makes simple co-location too noisy. MANTIS builds a heterogeneous graph of domains, IPs, subnets, and ASNs around daily seed malicious domains, guides the expansion to keep the graph small and toxic, and trains a semi-supervised GNN on lexical and hosting features to classify unseen domains. The claim is that this yields a practical early-warning system: 99.7% precision, 86.9% recall, 0.1% false positive rate, roughly 19,000 new malicious domains per day, typically days to weeks before VirusTotal or Google Safe Browsing flag them. The paper also reports a year-long operational deployment and a manual sanity-checking pipeline that confirmed the low false positive rate.

What carries the argument

The load-bearing mechanism is the guided expansion of a heterogeneous passive-DNS graph: starting from attacker-owned seed domains (filtered to exclude compromised and web-hosting domains), the system crawls recently seen resolutions two hops out, domain to IP to domain, restricted to the 200 most recent domains per IP, producing a graph roughly 5% the size of the full active-resolution graph but with much higher toxicity. Node features are lexical (brand-like tokens, subdomain structure), hosting (query counts, number of IPs and nameservers, duration), and novel IP-side features (number of apex domains hosted, query counts, duration). A semi-supervised heterogeneous GraphSAGE model with neighbor sampling and a final layer aggregating layer embeddings classifies unlabeled nodes; for on-demand use, embeddings from four weekly models are concatenated and fed to a Random Forest meta-learner, enabling inductive prediction on domains outside the training graph. A graph-neighborhood-based imputation fills missing features for nodes absent from the 7-day PDNS window.

What would settle it

Take a fresh set of MANTIS predictions that VirusTotal and GSB never flag, and run the paper's own manual verification on a larger sample than 1,000 domains, checking for independent signs of phishing or malware (parked or empty content, NX resolution patterns, brand impersonation). If the fraction of verified false positives exceeds the claimed 0.1% by an order of magnitude, the FPR claim is overstated. Alternatively, deploy the pipeline on a six-hour cadence and measure whether detection lead over VirusTotal grows; if it does not, the 'days to weeks' lead is partly an artifact of daily batch timing.

Watch

Extended reading notes

Core claim

MANTIS's central claim is that attacker-created malicious domains are detectable at hosting time from infrastructure reuse patterns alone, without looking at web content. Concretely, the paper reports that over 80% of IPs hosting malicious domains on a given day were reused from the previous 7 days, and that the toxicity of neighborhoods around previously malicious IPs is about 31.5 times higher than the global average. On a graph built by expanding from daily seed domains through passive DNS resolutions, a semi-supervised heterogeneous GraphSAGE model with lexical and hosting features achieves a test-time precision of 99.0% and recall of 95.6% at 0.5% FPR, and post-deployment precision of 99.7% with recall 86.9% at 0.1% FPR. The on-demand classifier, an ensemble of four weekly GNN models feeding a Random Forest meta-learner, classifies domains not present in the training graph, with AUC 0.998 across months. The paper's own sanity checking of 1,000 random predictions found 12 false positives, an FPR near 0.1%.

Load-bearing premise

That VirusTotal's consensus (at least five scanners) is a trustworthy oracle for what is malicious, and that the curated top-list and heuristic set is trustworthy for what is benign; if those labels are biased or delayed for certain attack types, the reported precision and recall overstate real-world performance.

Editorial extensions

If this is right

  • Security teams can generate a fresh blocklist in about two hours per day, flagging roughly 19,000 new attacker-owned domains before they serve content.
  • MANTIS is several days ahead of VirusTotal and Google Safe Browsing for domains it flags, and it catches domains those services never report: about 18% of its predictions are marked by GSB the first day, rising only about 12 points over the next two months.
  • The method degrades gracefully under practical adversarial manipulation (MimicIP and MintA), remaining above 90% accuracy at 15% perturbation, and adversarial training essentially restores clean performance.
  • The approach does not detect compromised domains or malicious content on web-hosting services; those require complementary detectors, as the paper states in its limitations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the infrastructure-reuse premise holds across time, the same guided-expansion graph could be applied to other abuse signals such as certificate transparency logs, WHOIS registration clustering, or redirection chains, which the paper itself suggests as extensions.
  • The emphasis on attacker-owned domains means the roughly 18% of malicious domains that are compromised are out of scope; a defender pairing MANTIS with a compromised-domain detector would cover the full daily malicious set.
  • A testable extension would run the pipeline at 6-hour or shorter intervals; the paper notes the one-day cadence is a practical choice, not a hard limit, and faster cadence may improve proactive detection.
  • Because the benign ground truth is deliberately built from unpopular, newly observed domains as well as top lists, the reported 0.1% FPR may transfer better to long-tail benign domains than models trained on top lists alone; this is an assertion that could be checked on a separate long-tail corpus.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents MANTIS, a content-agnostic system for early detection of attacker-created malicious domains. It constructs a heterogeneous graph from passive DNS and VirusTotal-derived seed domains, with nodes for domains, IPs, subnets, and ASNs, and uses lexical, hosting, and IP features. A semi-supervised GraphSAGE model is trained on weekly graphs for daily blocklist generation, while an ensemble of four weekly GNN encoders with a random-forest meta-learner supports inductive on-demand predictions for domains outside the training graph. The evaluation includes three temporally separated training windows with next-day held-out tests, next-month on-demand tests, comparisons against prior methods, adversarial robustness experiments, and a manual sanity check of 1,000 predictions from one day. The paper claims an average of about 19K malicious domains detected per day, over five times the daily VirusTotal volume, with precision 99.7%, recall 86.9%, FPR 0.1%, and detections days to weeks before popular blocklists.

Significance. If the precision and early-detection claims are validated, MANTIS would be a significant practical contribution: it has been operational for over a year, the code and daily blocklists are released, and the evaluation is more thorough than typical domain-reputation papers, with temporally separated train/test splits, next-month on-demand tests, feature-importance analysis, and robustness to two recent adversarial DNS attacks. However, the headline numbers rest on VirusTotal-derived ground truth and on a manual sanity check that verifies only 164 of 1,000 sampled predictions, so the independent validation is currently too weak to support the claimed 0.1% FPR and the 19K/day operational figure.

major comments (4)
  1. [§6.2, Table 9] The sanity-check precision of 0.988 is not an empirically measured precision. Only 164 of the 1,000 randomly sampled domains were manually verified; the remaining 836 are labeled malicious from NXDomain (653), no content (134), parked (14), and brand-impersonation (35) signals, and the text explicitly states that these signals 'are not concluding evidences for the maliciousness of domains.' All 12 false positives were found among the 164 manually verified domains, giving a manual-subset precision of 152/164 = 92.7%; if the same false-positive rate were applied to the 836 unverified domains, the overall precision would be roughly 92.7%, not 98.8%. Since the 19K/day and 5x-VirusTotal claims are counts of these same predictions, the central operational claim is not established by the presented validation. Please report precision on a larger independently verified random sample with binomial confidence intervals, or provide a validated labeling protocol for the non-manual categories.
  2. [§6.2] The FPR estimate 12/10,000 ≈ 0.1% is unexplained. The denominator 10,000 is never defined in the manuscript; it is not the number of benign domains in the September 8, 2022 test set (Table 1 lists 1,842 benign test domains), nor is it described as a separate random benign sample. If the denominator is the benign ground truth from the training set, the FPR is circular with respect to the VirusTotal-based ground truth. Please specify the composition and collection of the 10,000-domain set and justify the calculation.
  3. [Abstract and §5.4/Table 2] The headline metrics in the abstract (precision 99.7%, recall 86.9%, FPR 0.1%) do not match any single operating point reported in the experimental tables. Table 2 reports testing precision between 0.981 and 0.990 with recall between 0.898 and 0.921 at 0.5% FPR; §5.4 gives recall 86.9% at 0.1% FPR but does not state the corresponding precision. Please state explicitly which operating point produces the abstract's precision and recall, report the full precision/recall/FPR triple at that threshold, and provide confidence intervals.
  4. [§4.1] Training and evaluation share the same label source: seed domains, malicious ground truth, and test labels are all derived from VirusTotal with a five-engine threshold. Consequently, the reported precision and recall largely measure agreement with VirusTotal's aggregated scanner labels rather than with an independent ground truth. This is standard supervised practice, but it means the only genuinely independent validation is the §6.2 sanity check, which is insufficient as detailed above. To support the zero-day claim, please report daily-blocklist performance against independent sources (e.g., GSB, PhishTank, OpenPhish) using a protocol like that in Table 6, and make explicit how many of the daily predictions are first seen by MANTIS rather than already present in the VirusTotal feed.
minor comments (5)
  1. [§6.4] The reference to 'Figure 6.1' should be 'Figure 14.'
  2. [Table 8] The column headers in Table 8 are concatenated and hard to read (e.g., 'FreenomBrand SquattingADNS ResolvesParkingContent LengthVT Pos.'); please use separate columns with clear labels.
  3. [Conclusion and §6.2] The conclusion states that VT and GSB have a blind spot for at least 20% of detected malicious domains, but §6.2 reports that 17.7% of the 1,000-sample domains are not marked by any VT engine; please reconcile these numbers or clarify that the 20% refers to the combined blind spot of VT and GSB.
  4. [Appendix F] The response to the meta-review claims that ground truth from small oracles such as PhishTank 'can still detect malicious domains with over 90% precision and recall,' but no experiment in the paper directly supports this claim; please add the supporting result or soften the statement.
  5. [§3.1] The phrase 'we crawl PDNS of recently hosted domains' should read 'we crawl PDNS records of recently hosted domains' for clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the derivation is a standard supervised temporal holdout evaluation, and no claim reduces by construction to its inputs.

full rationale

MANTIS's derivation chain is a conventional supervised machine-learning pipeline: VirusTotal-based labels define the operational ground truth for both training and evaluation, and the reported precision, recall, and FPR are measured on temporally held-out test graphs rather than on the training labels themselves. Sharing the label source between training and evaluation is a validity limitation (the metrics partly measure agreement with VirusTotal rather than an independent oracle), but it is not a circular reduction, because the model's predictions are not defined in terms of the same per-domain labels used to score them, and the paper includes a separate sanity check on previously unseen predictions (Section 6.2). The authors' self-citations, e.g., [20], [27], and [38], are prior-work baselines, thresholds, or data sources, not load-bearing uniqueness arguments, and no ansatz is smuggled in solely through those citations. The Section 6.2 validation is weaker than the headline claims (only 164 of 1000 domains manually verified, and the FPR denominator of 10,000 is unexplained), but that is a correctness and robustness concern, not a circularity of the derivation chain. The core graph-expansion and inductive GNN contributions are self-contained and are not equivalent to their inputs by construction.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on domain assumptions about attacker infrastructure reuse, passive DNS coverage, and the reliability of VirusTotal and curated top-list ground truth. The free parameters are the operating threshold and several graph construction hyperparameters, all tuned on the authors' own validation periods. No new physical or conceptual entity is introduced.

free parameters (5)
  • VT scanner threshold for malicious ground truth = 5 engines (and 3 for active scan)
    Domains are labeled malicious only if at least five VirusTotal engines agree; this threshold defines both seeds and evaluation labels.
  • FPR operating threshold = 0.1%
    Headline precision 99.7% and recall 86.9% are reported at this chosen operating point.
  • PDNS expansion rate = 200 recent domains per IP
    Selected by grid search to trade F1 against FPR; directly shapes graph toxicity and the detected set.
  • Training window size = 7 days
    Selected because FPR converges near 1% from day 7 onward; used for all daily blocklist models.
  • Number of ensemble GNN encoders = 4
    Selected by measuring accuracy and FPR on Alexa top 100K; used in the on-demand classifier.
assumptions (5)
  • domain assumption Attackers reuse and rotate hosting infrastructure, so new malicious domains concentrate around IPs that recently hosted malicious domains.
    Foundation of the graph-expansion approach; empirically supported by Fig. 2 (over 80% IP reuse within 7 days) but not universally true.
  • domain assumption Farsight passive DNS covers about 90% of domains and its records are representative of actual domain-to-IP mappings.
    The entire graph and features are built from PDNS; Section 8 acknowledges the 10% coverage gap reduces seed recall.
  • domain assumption VirusTotal aggregation of at least five scanners is a reliable indicator of maliciousness.
    Used for seeds, malicious ground truth, and post-analysis in Section 4.1.
  • domain assumption Domains consistently in top lists for 30 days are benign, and curated heuristics can produce an unbiased benign set.
    Benign ground truth is built from Alexa, Umbrella, Tranco, CrUX, and heuristic filtering in Section 4.1.
  • domain assumption After pruning public hosting domains, the DNS hosting graph preserves homophily for attacker-created domains.
    GraphSAGE label propagation relies on neighboring nodes being similar; this motivates the pruning of blogspot-like public domains in Section 4.2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MANTIS: Detection of Zero-Day Malicious Domains Leveraging Low Reputed Hosting Infrastructure." pith.science (2026). https://pith.science/paper/PLACG4VM

@misc{pith2026250209788,
  author       = {Pith},
  title        = {Pith review of: MANTIS: Detection of Zero-Day Malicious Domains Leveraging Low Reputed Hosting Infrastructure},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PLACG4VM}},
  note         = {Machine review of arXiv:2502.09788}
}
read the original abstract

Internet miscreants increasingly utilize short-lived disposable domains to launch various attacks. Existing detection mechanisms are either too late to catch such malicious domains due to limited information and their short life spans or unable to catch them due to evasive techniques such as cloaking and captcha. In this work, we investigate the possibility of detecting malicious domains early in their life cycle using a content-agnostic approach. We observe that attackers often reuse or rotate hosting infrastructures to host multiple malicious domains due to increased utilization of automation and economies of scale. Thus, it gives defenders the opportunity to monitor such infrastructure to identify newly hosted malicious domains. However, such infrastructures are often shared hosting environments where benign domains are also hosted, which could result in a prohibitive number of false positives. Therefore, one needs innovative mechanisms to better distinguish malicious domains from benign ones even when they share hosting infrastructures. In this work, we build MANTIS, a highly accurate practical system that not only generates daily blocklists of malicious domains but also is able to predict malicious domains on-demand. We design a network graph based on the hosting infrastructure that is accurate and generalizable over time. Consistently, our models achieve a precision of 99.7%, a recall of 86.9% with a very low false positive rate (FPR) of 0.1% and on average detects 19K new malicious domains per day, which is over 5 times the new malicious domains flagged daily in VirusTotal. Further, MANTIS predicts malicious domains days to weeks before they appear in popular blocklists.

Figures

Figures reproduced from arXiv: 2502.09788 by the authors.

Figure 1
Figure 1. MANTIS vs. Existing Approaches: MANTIS detects malicious domains much early at the hosting time compared to many of the existing techniques which often detect domains only after the web content is available. of detection solutions have been proposed and deployed in practice, many malicious domains either go undetected or get detected only after users are compromised. Thus, adapt￾ing security solutions to defend agai… view at source ↗
Figure 2
Figure 2. Reuse of Hosting Infrastructure. Over 80% of IP addresses used to host malicious domains on a given day were found to be reused from the previous 7 days. to the deficiencies in the constructed graph, specifically the lack of preservation of the homophily property. A malicious domain could be compromised (i.e. benign domains exploited by attackers) or attacker-created (i.e. the domain registered by attackers). Throug… view at source ↗
Figure 3
Figure 3. Overall pipeline for daily blocklist generation. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (13 more)
Figure 5
Figure 5. Figure 5: Graph schema. dataset, enabling us to train a generalizable classifier with a lower false positive rate. When we examine the distribution of our benign ground truth across different categories, we observe that approximately 54% of the benign ground truth comes from pop…
Figure 6
Figure 6. Figure 6: (a) Validation, (b) Testing ROCs for daily blocklist. [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: (a) Validation, (b) Testing ROCs for meta-learner. [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Graph structure comparison. yields a high F1-score and a low FPR. Fig. 9c and 9d show the F1-score and FPR for different expansion rates from 50 to 250, respectively. It shows that as the expansion increases, F1-score falls slowly while FPR falls rapidly and plateaus a…
Figure 10
Figure 10. Figure 10: Generalizability of the model [PITH_FULL_IMAGE:figures/full_fig_p009_10.png]
Figure 12
Figure 12. Figure 12: Robustness of standard and adversarially trained [PITH_FULL_IMAGE:figures/full_fig_p010_12.png]
Figure 13
Figure 13. Figure 13: (a) Acc., (b) FPR for different ensemble counts. [PITH_FULL_IMAGE:figures/full_fig_p011_13.png]
Figure 15
Figure 15. Figure 15: Number of newly detected malicious domains. [PITH_FULL_IMAGE:figures/full_fig_p011_15.png]
Figure 16
Figure 16. Figure 16: Sanity checking for 60 consec. days. remaining suspicious domains. In this way, we not only rely on the output of the machine learning models but also have the chance to observe new attack behaviors and update our approach. For each day, we report VT malicious counts,…
Figure 17
Figure 17. Figure 17: Campaigns abusing (a) web3 domains (b) Ap [PITH_FULL_IMAGE:figures/full_fig_p013_17.png]
Figure 18
Figure 18. Figure 18: VT Positives Distribution of Seed Domains’ Neighbors. The y-axis indicates the percentage of nodes flagged as malicious by at least x VT engines. Notably, 16.65% of previously unknown domains are flagged as malicious by at least one engine, indicating our success in r…
Figure 19
Figure 19. Figure 19: Impact of GNN architectures, embedding dimen [PITH_FULL_IMAGE:figures/full_fig_p017_19.png]
Figure 20
Figure 20. Figure 20: Daily blocklist generation time by seed size. [PITH_FULL_IMAGE:figures/full_fig_p018_20.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

98 extracted references · 77 canonical work pages

  1. [1]

    Janos, F

    S. Janos, F. Shehroze, and M. Nabeel. (2023) Toward Ending the Domain Wars: Early Detection of Malicious Stockpiled Domains. https://tinyurl.com/5xnh5d39. Accessed: 28-04-2024

    2023

  2. [2]

    (2023) Cost of a Data Breach Report 2023

    IBM. (2023) Cost of a Data Breach Report 2023. https://www.ibm. com/reports/data-breach/. Accessed: 16-01-2024

    2023

  3. [3]

    Premadoma: An operational solution for dns registries to prevent malicious domain registrations,

    J. Spooren, T. Vissers, P. Janssen, W. Joosen, and L. Desmet, “Premadoma: An operational solution for dns registries to prevent malicious domain registrations,” in ACSAC, 2019

    2019

  4. [4]

    Detection of algorithmically generated domain names used by bot- nets: a dual arms race,

    J. Spooren, D. Preuveneers, L. Desmet, P. Janssen, and W. Joosen, “Detection of algorithmically generated domain names used by bot- nets: a dual arms race,” in ACM/SIGAPP SAC, 2019

    2019

  5. [5]

    Assessing the effec- tiveness of domain blacklisting against malicious dns registrations,

    T. Vissers, P. Janssen, W. Joosen, and L. Desmet, “Assessing the effec- tiveness of domain blacklisting against malicious dns registrations,” in IEEE Security and Privacy Workshops (SPW) , 2019

    2019

  6. [6]

    Real- time content-based cyber threat detection with machine learning,

    E. Kocyigit, M. Korkmaz, O. K. Sahingoz, and B. Diri, “Real- time content-based cyber threat detection with machine learning,” in Intelligent Systems Design and Applications . Springer, 2021

    2021

  7. [7]

    High- performance content-based phishing attack detection,

    B. Wardman, T. Stallings, G. Warner, and A. Skjellum, “High- performance content-based phishing attack detection,” in2011 eCrime Researchers Summit. IEEE, 2011, pp. 1–9

    2011

  8. [8]

    Phishskape: A content based approach to escape phishing attacks,

    A. K. Jain, S. Parashar, P. Katare, and I. Sharma, “Phishskape: A content based approach to escape phishing attacks,” Procedia Computer Science, vol. 171, pp. 1102–1109, 2020

    2020

Show all 98 references
  1. [9]

    Crawlphish: Large-scale analysis of client-side cloaking techniques in phishing,

    P. Zhang, A. Oest, H. Cho, Z. Sun, R. Johnson, B. Wardman et al., “Crawlphish: Large-scale analysis of client-side cloaking techniques in phishing,” in IEEE Symposium on Security and Privacy (SP), 2021

    2021

  2. [10]

    Finding the linch- pins of the dark web: A study on topologically dedicated hosts on malicious web infrastructures

    Z. Li, S. Alrwais, Y . Xie, F. Yu, and X. Wang, “Finding the linch- pins of the dark web: A study on topologically dedicated hosts on malicious web infrastructures.” IEEE Computer Society, 2013

    2013

  3. [11]

    (2024) Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

    Stijn, Tilborghs and Connor, Faulkner. (2024) Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself. https: //tinyurl.com/4a7a7mhz. Accessed: 28-04-2024

    2024

  4. [12]

    Shehroze, T

    F. Shehroze, T. Howard, S. Alex, M. Nabeel, R. Lu, and Z. Chen. (2024) ApateWeb: An Evasive Large-Scale Scareware and PUP Deliv- ery Campaign. https://tinyurl.com/ycxtwyrc. Accessed: 28-04-2024

    2024

  5. [13]

    Building a Dynamic Reputation System for DNS,

    M. Antonakakis, R. Perdisci, D. Dagon, W. Lee, and N. Feamster, “Building a Dynamic Reputation System for DNS,” in Proceedings of the 19th USENIX Conference on Security , 2010, pp. 273–290

    2010

  6. [14]

    Expo- sure: A passive dns analysis service to detect and report malicious domains,

    L. Bilge, S. Sen, D. Balzarotti, E. Kirda, and C. Kruegel, “Expo- sure: A passive dns analysis service to detect and report malicious domains,” ACM Transactions on Information Systems Security , 2014

    2014

  7. [15]

    A lexical approach for classifying malicious urls,

    M. Darling, H. Greg, G. Gressel, A. Ashok, and P. Poornachandran, “A lexical approach for classifying malicious urls,” in HPCS, 2015

    2015

  8. [16]

    Domain classifier: Compromised machines versus malicious regis- trations,

    S. L. Page, G. Jourdan, G. von Bochmann, I. Onut, and J. Flood, “Domain classifier: Compromised machines versus malicious regis- trations,” in 19th International Conference Web Engineering , 2019

    2019

  9. [17]

    {FANCI}: Feature-based automated {NXDomain} classification and intelli- gence,

    S. Sch ¨uppen, D. Teubert, P. Herrmann, and U. Meyer, “ {FANCI}: Feature-based automated {NXDomain} classification and intelli- gence,” in 27th USENIX Security Symposium , 2018, pp. 1165–1181

    2018

  10. [18]

    Polonium: Tera-scale graph mining and inference for malware detection,

    D. H. Chau, C. Nachenberg, J. Wilhelm, A. Wright, and C. Falout- sos, “Polonium: Tera-scale graph mining and inference for malware detection,” in SIAM International Conference on Data Mining , 2011

    2011

  11. [19]

    Nazca: Detecting malware distribution in large-scale networks

    L. Invernizzi, S. Miskovic, R. Torres, C. Kruegel, S. Saha, G. Vigna, S.-J. Lee, and M. Mellia, “Nazca: Detecting malware distribution in large-scale networks.” in NDSS, vol. 14, 2014, pp. 23–26

    2014

  12. [20]

    Following passive dns traces to detect stealthy malicious domains via graph inference,

    M. Nabeel, I. M. Khalil, B. Guan, and T. Yu, “Following passive dns traces to detect stealthy malicious domains via graph inference,” ACM Trans. Priv. Secur., vol. 23, no. 4, 2020

    2020

  13. [21]

    Marmite: spreading malicious file reputation through download graphs,

    G. Stringhini, Y . Shen, Y . Han, and X. Zhang, “Marmite: spreading malicious file reputation through download graphs,” in ACSAC, 2017

    2017

  14. [22]

    Node2vec: Scalable feature learning for networks,

    A. Grover and J. Leskovec, “Node2vec: Scalable feature learning for networks,” in ACM SIGKDD, ser. KDD ’16, 2016

    2016

  15. [23]

    Practical attacks against dns reputation systems,

    T. Galloway, K. Karakolios, Z. Ma, R. Perdisci, A. Keromytis, and M. Antonakakis, “Practical attacks against dns reputation systems,” in IEEE Symposium on Security and Privacy (SP) , 2024

    2024

  16. [24]

    Phishing url detection: A network-based approach robust to evasion,

    T. Kim, N. Park, J. Hong, and S.-W. Kim, “Phishing url detection: A network-based approach robust to evasion,” in ACM CCS, 2022

    2022

  17. [25]

    Ringer: Systematic mining of malicious domains by dynamic graph convolutional net- work,

    Z. Liu, S. Li, Y . Zhang, X. Yun, and C. Peng, “Ringer: Systematic mining of malicious domains by dynamic graph convolutional net- work,” in ICCS. Springer International Publishing, 2020

    2020

  18. [26]

    Hgdom: Heterogeneous graph convolutional networks for malicious domain detection,

    X. Sun, J. Yang, Z. Wang, and H. Liu, “Hgdom: Heterogeneous graph convolutional networks for malicious domain detection,” in IEEE/IFIP NOMS, 2020

    2020

  19. [27]

    Compromised or Attacker-Owned: A large scale classifi- cation and study of hosting domains of malicious URLs,

    R. D. Silva, M. Nabeel, C. Elvitigala, I. Khalil, T. Yu, and C. Keppi- tiyagama, “Compromised or Attacker-Owned: A large scale classifi- cation and study of hosting domains of malicious URLs,” in USENIX Security Symposium, 2021, pp. 3721–3738

    2021

  20. [28]

    Classifying phishing urls using recurrent neural networks,

    A. C. Bahnsen, E. C. Bohorquez, S. Villegas, J. Vargas, and F. A. Gon- zalez, “Classifying phishing urls using recurrent neural networks,” in eCrime, 2017, pp. 1–8

    2017

  21. [29]

    Inductive representation learning on large graphs,

    W. Hamilton, Z. Ying, and J. Leskovec, “Inductive representation learning on large graphs,” in NIPS, 2017

    2017

  22. [30]

    Heterogeneous graph trans- former,

    Z. Hu, Y . Dong, K. Wang, and Y . Sun, “Heterogeneous graph trans- former,” in WWW, 2020

    2020

  23. [31]

    Semi-Supervised Classification with Graph Convolutional Networks,

    T. Kipf and M. Welling, “Semi-Supervised Classification with Graph Convolutional Networks,” in ICLR, 2017

    2017

  24. [32]

    Modeling relational data with graph convolutional networks,

    M. Schlichtkrull, T. Kipf, P. Bloem, R. van den Berg, I. Titov, and M. Welling, “Modeling relational data with graph convolutional networks,” in The Semantic Web, 2018, pp. 593–607

    2018

  25. [33]

    Graph attention networks,

    P. Veli ˇckovi´c, G. Cucurull, A. Casanova, A. Romero, P. Li `o, and Y . Bengio, “Graph attention networks,” in ICLR, 2018

    2018

  26. [34]

    (2022) DNS Database

    Farsight Security, Inc. (2022) DNS Database. https://www.dnsdb.info/. Accessed: 28-09-2023

    2022

  27. [35]

    Online Virus, Malware and URL Scanner,

    VirusTotal, “Online Virus, Malware and URL Scanner,” https://www. virustotal.com/, 2023, Accessed: 04-03-2023

    2023

  28. [36]

    Google Safe Browsing,

    Google, “Google Safe Browsing,” https://developers.google.com/ safe-browsing/, 2016, accessed: 10-08-2023

    2016

  29. [37]

    PhishTank,

    OpenDNS, “PhishTank,” https://www.phishtank.com/, 2023, ac- cessed: 16-02-23

    2023

  30. [38]

    Content-agnostic detection of phishing domains using certificate transparency and passive dns,

    M. AlSabah, M. Nabeel, Y . Boshmaf, and E. Choo, “Content-agnostic detection of phishing domains using certificate transparency and passive dns,” in RAID, 2022

    2022

  31. [39]

    Alexa Top Sites,

    Alexa, “Alexa Top Sites,” http://aws.amazon.com/alexa-top-sites/, 2022, Accessed: 30-03-2022

    2022

  32. [40]

    Cisco Umbrella,

    Cisco, “Cisco Umbrella,” https://umbrella.cisco.com/, 2022, Ac- cessed: 30-09-2022

    2022

  33. [41]

    Tranco: A research-oriented top sites ranking hard- ened against manipulation,

    V . L. Pochat, T. Van Goethem, S. Tajalizadehkhoob, M. Korczy ´nski, and W. Joosen, “Tranco: A research-oriented top sites ranking hard- ened against manipulation,” arXiv preprint arXiv:1806.01156 , 2018

    2018 arXiv

  34. [42]

    The Chrome User Experience Report,

    Google, “The Chrome User Experience Report,” https://developer. chrome.com/docs/crux/, 2022, Accessed: 28-12-2023

    2022

  35. [43]

    Majestic Million,

    Majestic, “Majestic Million,” https://majestic.com/reports/ majestic-million/, 2023, Accessed: 05-02-2023

    2023

  36. [44]

    Top- pling top lists: Evaluating the accuracy of popular website lists,

    K. Ruth, D. Kumar, B. Wang, L. Valenta, and Z. Durumeric, “Top- pling top lists: Evaluating the accuracy of popular website lists,” in ACM IMC, 2022

    2022

  37. [45]

    Getting under alexa’s umbrella: Infiltration attacks against internet top domain lists,

    W. Rweyemamu, T. Lauinger, C. Wilson, W. Robertson, and E. Kirda, “Getting under alexa’s umbrella: Infiltration attacks against internet top domain lists,” in Information Security (ISC) , 2019

    2019

  38. [46]

    Handling missing data with graph representation learning,

    J. You, X. Ma, Y . Ding, M. Kochenderfer, and J. Leskovec, “Handling missing data with graph representation learning,” in NeurIPS, 2020. To Appear in 46th IEEE Symposium on Security and Privacy (S&P) Conference, May 2025

    2020

  39. [47]

    (2023) Public suffix list

    Mozilla Foundation. (2023) Public suffix list. https://publicsuffix.org/. Accessed: 15-08-2023

    2023

  40. [48]

    We know it before you do: predicting malicious domains,

    W. Xu, K. Sanders, and Y . Zhang, “We know it before you do: predicting malicious domains,” in Virus Bulletin Conference, 2014

    2014

  41. [49]

    The Real Yellow Pages,

    Thryv, LLC, “The Real Yellow Pages,” https://www.yellowpages. com/, 2023, Accessed: 04-08-2023

    2023

  42. [50]

    Segugio: Efficient Behavior-Based Tracking of Malware-Control Domains in Large ISP Networks,

    B. Rahbarinia, R. Perdisci, and M. Antonakakis, “Segugio: Efficient Behavior-Based Tracking of Malware-Control Domains in Large ISP Networks,” in Dependable Systems and Networks (DSN) , 2015

    2015

  43. [51]

    Exposure: Finding malicious domains using passive dns analysis,

    L. Bilge, E. Kirda, C. Kruegel, and M. Balduzzi, “Exposure: Finding malicious domains using passive dns analysis,” in NDSS, 2011

    2011

  44. [52]

    (2024) SinkDB

    AbuseCH. (2024) SinkDB. https://sinkdb.abuse.ch/. Accessed: 20-01- 2024

    2024

  45. [53]

    (2024) MISP Threat Sharing

    MISP Project. (2024) MISP Threat Sharing. https://github.com/MISP/ misp-warninglists/tree/main/lists/sinkholes/. Accessed: 20-01-2024

    2024

  46. [54]

    Modeling relational data with graph convolutional networks,

    M. Schlichtkrull, T. N. Kipf, P. Bloem, R. Van Den Berg, I. Titov, and M. Welling, “Modeling relational data with graph convolutional networks,” in The Semantic Web. Springer, 2018

    2018

  47. [55]

    Semi-supervised random forests,

    C. Leistner, A. Saffari, J. Santner, and H. Bischof, “Semi-supervised random forests,” in ICCV, 2009

    2009

  48. [56]

    Xgboost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “Xgboost: A scalable tree boosting system,” in ACM SIGKDD, 2016, pp. 785–794

    2016

  49. [57]

    Lightgbm: A highly efficient gradient boosting decision tree,

    G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y . Liu, “Lightgbm: A highly efficient gradient boosting decision tree,” NeurIPS, vol. 30, 2017

    2017

  50. [58]

    Lakemeyer and B

    G. Lakemeyer and B. Nebel, Exploring artificial intelligence in the new millennium. Morgan Kaufmann, 2003

    2003

  51. [59]

    Handom: Heterogeneous attention network model for malicious domain detection,

    Q. Wang, C. Dong, S. Jian, D. Du, Z. Lu, Y . Qi, D. Han, X. Ma, F. Wang, and Y . Liu, “Handom: Heterogeneous attention network model for malicious domain detection,” Computers & Security, 2023

    2023

  52. [60]

    Blocklist-Forecast: Proactive Domain Blocklisting by Identifying Malicious Hosting In- frastructure,

    U. Kumarasinghe, M. Nabeel, and C. Elvitigala, “Blocklist-Forecast: Proactive Domain Blocklisting by Identifying Malicious Hosting In- frastructure,” in RAID, October 2024

    2024

  53. [61]

    Multi- instance adversarial attack on gnn-based malicious domain detection,

    M. Nazzal, I. Khalil, A. Khreishah, N. Phan, and Y . Ma, “Multi- instance adversarial attack on gnn-based malicious domain detection,” in IEEE Symposium on Security and Privacy (SP) , 2024

    2024

  54. [62]

    Everybody’s got ml, tell me what else you have: Practitioners’ perception of ml-based security tools and explanations,

    J. Mink, H. Benkraouda, L. Yang, A. Ciptadi, A. Ahmadzadeh, D. V otipka, and G. Wang, “Everybody’s got ml, tell me what else you have: Practitioners’ perception of ml-based security tools and explanations,” in IEEE Symposium on Security and Privacy , 2023

    2023

  55. [63]

    Gnnex- plainer: Generating explanations for graph neural networks,

    R. Ying, D. Bourgeois, J. You, M. Zitnik, and J. Leskovec, “Gnnex- plainer: Generating explanations for graph neural networks,”NeurIPS, vol. 32, 2019

    2019

  56. [64]

    Captum: A unified and generic model interpretability library for pytorch,

    N. Kokhlikyan, V . Miglani, M. Martin, E. Wang et al., “Captum: A unified and generic model interpretability library for pytorch,” arXiv preprint arXiv:2009.07896, 2020

    2009 arXiv

  57. [65]

    Exploring the ecosystem of malicious domain registrations in the. eu tld,

    T. Vissers, J. Spooren, P. Agten, D. Jumpertz, P. Janssen, M. Van, F. Piessens, W. Joosen, and L. Desmet, “Exploring the ecosystem of malicious domain registrations in the. eu tld,” in RAID, 2017

    2017

  58. [66]

    Understanding the domain registration behavior of spammers,

    S. Hao, M. Thomas, V . Paxson, N. Feamster, C. Kreibich, C. Grier, and S. Hollenbeck, “Understanding the domain registration behavior of spammers,” in ACM IMC, 2013

    2013

  59. [67]

    Sunrise to sunset: Analyzing the end-to-end life cycle and effectiveness of phishing attacks at scale,

    A. Oest, P. Zhang, B. Wardman, E. Nunes, J. Burgis, A. Zand, K. Thomas, A. Doup ´e, and G.-J. Ahn, “Sunrise to sunset: Analyzing the end-to-end life cycle and effectiveness of phishing attacks at scale,” in USENIX Security Symposium , 2020

    2020

  60. [68]

    Phishnet: Pre- dictive blacklisting to detect phishing attacks,

    P. Prakash, M. Kumar, R. Kompella, and M. Gupta, “Phishnet: Pre- dictive blacklisting to detect phishing attacks,” in INFOCOM, 2010

    2010

  61. [69]

    On the potential of proactive domain blacklisting,

    M. Felegyhazi, C. Kreibich, and V . Paxson, “On the potential of proactive domain blacklisting,” in Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More , ser. LEET’10, 2010

    2010

  62. [70]

    Evilseed: A guided approach to finding malicious web pages,

    L. Invernizzi, P. M. Comparetti, S. Benvenuti, C. Kruegel, M. Cova, and G. Vigna, “Evilseed: A guided approach to finding malicious web pages,” in IEEE Symposium on Security and Privacy , 2012

    2012

  63. [71]

    PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration,

    S. Hao, A. Kantchelian, B. Miller, V . Paxson, and N. Feamster, “PREDATOR: Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration,” in ACM SIGSAC CCS , 2016

    2016

  64. [72]

    Beyond blacklists: Learning to detect malicious web sites from suspicious urls,

    J. Ma, L. K. Saul, S. Savage, and G. M. V oelker, “Beyond blacklists: Learning to detect malicious web sites from suspicious urls,” in ACM SIGKDD, ser. KDD ’09, 2009

    2009

  65. [73]

    Detecting Malicious Activity with DNS Backscatter,

    K. Fukuda and J. Heidemann, “Detecting Malicious Activity with DNS Backscatter,” in ACM IMC, 2015, pp. 197–210

    2015

  66. [74]

    DeepDGA: Adversarially-Tuned Domain Generation and Detection,

    H. S. Anderson, J. Woodbridge, and B. Filar, “DeepDGA: Adversarially-Tuned Domain Generation and Detection,” in ACM Workshop on Artificial Intelligence and Security , 2016

    2016

  67. [75]

    A Method for Detecting DGA Botnet Based on Semantic and Cluster Analysis,

    V . Tong and G. Nguyen, “A Method for Detecting DGA Botnet Based on Semantic and Cluster Analysis,” in SOICT, 2016

    2016

  68. [76]

    Who is .com?: Learning to parse whois records,

    S. Liu, I. Foster, S. Savage, G. M. V oelker, and L. K. Saul, “Who is .com?: Learning to parse whois records,” in ACM IMC, 2015

    2015

  69. [77]

    Towards Systematic Evaluation of the Evadability of Bot/Botnet Detection Methods,

    E. Stinson and J. C. Mitchell, “Towards Systematic Evaluation of the Evadability of Bot/Botnet Detection Methods,” in USENIX Workshop on Offensive Technologies, 2008

    2008

  70. [78]

    Who controls the internet? analyzing global threats using property graph traversals,

    M. Simeonovski, G. Pellegrino, C. Rossow, and M. Backes, “Who controls the internet? analyzing global threats using property graph traversals,” in WWW, 2017

    2017

  71. [79]

    Malrank: A measure of maliciousness in siem-based knowledge graphs,

    P. Najafi, A. M ¨uhle, W. P ¨unter, F. Cheng, and C. Meinel, “Malrank: A measure of maliciousness in siem-based knowledge graphs,” in ACSAC, 2019

    2019

  72. [80]

    Hindom: A robust malicious domain detection system based on heterogeneous information network with transductive classification,

    X. Sun, M. Tong, J. Yang, L. Xinran, and L. Heng, “Hindom: A robust malicious domain detection system based on heterogeneous information network with transductive classification,” in RAID, 2019

    2019

  73. [81]

    Deepdom: Malicious do- main detection with scalable and heterogeneous graph convolutional networks,

    X. Sun, Z. Wang, J. Yang, and X. Liu, “Deepdom: Malicious do- main detection with scalable and heterogeneous graph convolutional networks,” Computers and Security , 2020

    2020

  74. [82]

    Attributed heterogeneous graph neural network for malicious domain detection,

    S. Zhang, Z. Zhou, D. Li, Y . Zhong, Q. Liu, W. Yang, and S. Li, “Attributed heterogeneous graph neural network for malicious domain detection,” in CSCWD, 2021

    2021

  75. [83]

    The Spamhaus Project,

    Spamhaus, “The Spamhaus Project,” https://www.spamhaus.org/, 2022, accessed: 25-08-2022

    2022

  76. [84]

    Computer Incident Response Center Luxembourg,

    CIRCL, “Computer Incident Response Center Luxembourg,” https: //circl.lu/, 2019, Accessed: 27-05-2019

    2019

  77. [85]

    Rapid7: Endpoint to Cloud, Command Your Attack Sur- face,

    Rapid7, “Rapid7: Endpoint to Cloud, Command Your Attack Sur- face,” https://www.rapid7.com/, 2022, Accessed: 29-06-2022

    2022

  78. [86]

    Comar: Classification of compromised versus maliciously registered domains,

    S. Maroofi, M. Korczy ´nski, C. Hesselman, B. Ampeau, and A. Duda, “Comar: Classification of compromised versus maliciously registered domains,” in 2020 IEEE EuroS&P , 2020, pp. 607–623

    2020

  79. [87]

    Hiding in plain sight: A longitudinal study of combosquatting abuse,

    P. Kintis, M. Najmeh, C. Lever, Y . Chen, R. Romero, N. Pitropakis, N. Nikiforakis, and A. Manos, “Hiding in plain sight: A longitudinal study of combosquatting abuse,” in ACM SIGSAC CCS , 2017

    2017

  80. [88]

    Phishing catcher using certstream,

    Phishing Catcher, “Phishing catcher using certstream,” https://github. com/x0rz/phishing catcher, 2015, Accessed: 20-09-2023. Appendix A. Graph Toxicity A key conceptual novelty in our work is the automated construction of a graph around attack domains and the guided graph exp...

    2015

  81. [89]

    Proactive detection: MANTIS can predict malicious domains days to weeks before they appear on popular blocklists, highlighting its proactive nature

  82. [90]

    The paper also reports the computa- tional performance

    Comprehensive evaluation: the paper performs a com- prehensive set of experiments and conducts a baseline comparison with existing ML approaches and SoTA (Tables 4 and 5). The paper also reports the computa- tional performance

  83. [91]

    High accuracy: the reported precision, recall, low false positive rate, and adversarial robustness support prac- tical applications

  84. [92]

    Operational system: Mantis has been already opera- tional for over a year, consistently detecting a sig- nificant number of malicious domains daily, which underscores its practicality. E.4. Noteworthy Concerns

  85. [93]

    The paper acknowledges this and dis- cusses potential solutions that are left for future work

    Detection limitations: the focus on attacker-created do- mains might overlook the importance of detecting com- promised domains, which are also significant in real- world scenarios. The paper acknowledges this and dis- cusses potential solutions that are left for future work. ...

  86. [94]

    Novel attack vectors that differ significantly from the training data may not be detected

    The detection performance of the system requires reli- able ground truth data from large scale oracles. Novel attack vectors that differ significantly from the training data may not be detected

  87. [95]

    Appendix F

    The practical potential of the proactive detection possi- ble by the framework is estimated (i.e., detection at the time of hosting setup) but not empirically evaluated. Appendix F. Response to the Meta-Review

  88. [96]

    One may devise novel graph based approaches to im- prove existing compromised and/or rentable domain detectors

    Detection limitation: As we discuss in the Limitations Section, our approach augments the existing compro- mised domain detectors and rentable domain detectors. One may devise novel graph based approaches to im- prove existing compromised and/or rentable domain detectors

  89. [97]

    Similar to other DL based approaches, if the attack vector is completely novel from the training data, it is likely to have a blind spot

    Large oracles: While GT from large oracles greatly improves the performance in terms of precision and recall, GT from small oracles such as PhishTank can still detect malicious domains with over 90% precision and recall. Similar to other DL based approaches, if the attack vect...

  90. [98]

    In order to fur- ther improve the proactiveness, one may execute our pipeline at intervals shorter than 1 day, for example, every 6 hours

    Proactive detection: In Section 6.3, we show our ap- proach is several days more proactive compared to VirusTotal, which is the most popular and the largest domain maliciousness lookup service. In order to fur- ther improve the proactiveness, one may execute our pipeline at in...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.