Measurement study on abnormal changes in authoritative resource records of government and educational domains - SUN Junzhe; LU Chaoyi; LIU Baojun; DUAN Haixin; SUN Donghong (Tongxin xuebao)
Authoritative-side domain hijacking is characterized by abnormal changes in resource records. To enable timely warnings for authoritative-side domain hijacking incidents, a monitoring system for authoritative-side resource records was established, targeting significant domains in key sectors such as government and education, as well as high-traffic popular domains. The system actively captured and continuously monitored 7.5 million important domains globally. An algorithm was developed to filter abnormal changes in resource records, identifying abnormal changes in 896 significant domains within a one-month analysis period. Manual verification results indicate that the causes included misconfigurations by domain administrators, phishing attacks, and the display of illegal content.