COBRA: A Content-Agnostic Framework for Zero-Day Detection of Suspicious Domains
COBRA clusters newly registered domain names to flag suspicious domains at registration time, finding 47K domains with 98.5% precision before threat intel does.
Researchers propose COBRA, a content-agnostic framework that detects suspicious domains at registration time by clustering names of newly registered domains by lexical and structural similarity, without needing any hosted content. Evaluated on 1.5M newly created domains, it achieved 98.5% precision and identified over 47K distinct suspicious domains. It identified 80% of suspicious or malicious domains earlier than a widely used threat-intelligence service, which in some cases needs up to 7 days.
- Classifies domains before content deployment using only name-based clustering
- 98.5% precision across 1.5M newly registered domains; 47K+ suspicious domains identified
- Flags 80% of malicious domains earlier than a leading threat-intelligence service
Full article198 words · extracted from arxiv.org · click to collapse
The use of malicious domains is central to cyberattacks such as phishing, malware distribution, impersonation, and fraudulent transactions. Because domains are inexpensive to register and easy to deploy at scale, they remain one of the most common and damaging tools used in cybercrime across industries. Proactive detection is essential to reducing this window of vulnerability and preventing harm to users. In this work, we propose COBRA: a content-agnostic, registration-time detection framework for identifying and analyzing suspicious domains from day zero. Our approach does not rely on any content-based features, allowing us to classify a domain even before it is populated with content. We analyze the names of newly registered domains and employ a clustering technique to group them based on lexical and structural similarity. We evaluate our methodology using real-world data consisting of 1.5M newly created domains, demonstrating that COBRA detects suspicious domains with a precision of 98.5%, identifying more than 47K distinct newly registered suspicious domains. Furthermore, our results show that domain-name clustering enables accurate early detection, allowing us to identify 80% of suspicious or malicious domains earlier than one of the most widely used threat-intelligence services, which in some cases may require up to 7 days.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.25882