Correlating Domain Registrations and DNS First Activity in General and for Malware
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
From the date that a domain name is registered with a registrar, there should be a pattern in the amount of time it takes for that domain to be actively resolved on the Internet. We first attempt to describe that pattern in general terms by correlating data from registries for several top-level domains and a large passive DNS data source. This pattern is then used as a baseline for a comparison with the pattern of activity in domains that malicious software utilizes. While our quantitative results are not to be considered representative of the patterns exhibited by all types of malware, the malicious domains are found to have a significantly different pattern than the standard domains.
Cite This SEI Report
Metcalf, L., Spring, J., & Stoner, E. (2011, April 11). Correlating Domain Registrations and DNS First Activity in General and for Malware. Retrieved September 4, 2026, from https://www.sei.cmu.edu/library/correlating-domain-registrations-and-dns-first-activity-in-general-and-for-malware/.
@techreport{metcalf_2011,
author={Metcalf, Leigh and Spring, Jonathan and Stoner, Ed},
title={Correlating Domain Registrations and DNS First Activity in General and for Malware},
month={Apr},
year={2011},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/correlating-domain-registrations-and-dns-first-activity-in-general-and-for-malware/},
note={Accessed: 2026-Sep-4}
}
Metcalf, Leigh, Jonathan Spring, and Ed Stoner. "Correlating Domain Registrations and DNS First Activity in General and for Malware." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, April 11, 2011. https://www.sei.cmu.edu/library/correlating-domain-registrations-and-dns-first-activity-in-general-and-for-malware/.
L. Metcalf, J. Spring, and E. Stoner, "Correlating Domain Registrations and DNS First Activity in General and for Malware," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 11-Apr-2011 [Online]. Available: https://www.sei.cmu.edu/library/correlating-domain-registrations-and-dns-first-activity-in-general-and-for-malware/. [Accessed: 4-Sep-2026].
Metcalf, Leigh, Jonathan Spring, and Ed Stoner. "Correlating Domain Registrations and DNS First Activity in General and for Malware." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 11 Apr. 2011. https://www.sei.cmu.edu/library/correlating-domain-registrations-and-dns-first-activity-in-general-and-for-malware/. Accessed 4 Sep. 2026.
Metcalf, Leigh; Spring, Jonathan; & Stoner, Ed. Correlating Domain Registrations and DNS First Activity in General and for Malware. Software Engineering Institute. 2011. https://www.sei.cmu.edu/library/correlating-domain-registrations-and-dns-first-activity-in-general-and-for-malware/