Framework detects suspicious domains early without using website content
COBRA: A Content-Agnostic Framework for Zero-Day Detection of Suspicious Domains
Cryptography and Security
Summary
Bad websites often use tricky web addresses to trick people or spread viruses. The authors created COBRA, a method that looks at new website names as soon as they are registered, even before any content appears. By grouping similar website names together, their system spots suspicious sites with high accuracy. This lets people stop harmful websites faster than many existing services, reducing risks to users.
What this means in practice
- •For security operations teams: Identify newly registered suspicious domains before harmful content appears to improve incident response times.
- •For network defenders: Create early warning systems that block or flag dangerous domains as soon as they are registered, enhancing network protection.
Authors
Alexandros Fourtounis, Emmanouil Papadogiannakis, Panagiotis Papadopoulos, Nicolas Kourtellis, Evangelos Markatos
Abstract
The use of malicious domains is central to cyberattacks such as phishing, malware distribution, impersonation, and fraudulent transactions. Because domains are inexpensive to register and easy to deploy at scale, they remain one of the most common and damaging tools used in cybercrime across industries. Proactive detection is essential to reducing this window of vulnerability and preventing harm to users. In this work, we propose COBRA: a content-agnostic, registration-time detection framework for identifying and analyzing suspicious domains from day zero. Our approach does not rely on any content-based features, allowing us to classify a domain even before it is populated with content. We analyze the names of newly registered domains and employ a clustering technique to group them based on lexical and structural similarity. We evaluate our methodology using real-world data consisting of 1.5M newly created domains, demonstrating that COBRA detects suspicious domains with a precision of 98.5%, identifying more than 47K distinct newly registered suspicious domains. Furthermore, our results show that domain-name clustering enables accurate early detection, allowing us to identify 80% of suspicious or malicious domains earlier than one of the most widely used threat-intelligence services, which in some cases may require up to 7 days.