Alias Equals Zone? Large-Scale and Stealthy Takeover of Domain Hosting Service via CNAME-Following Cross-Domain Verification

The HostingEye directory contains code for detecting the hosting status of email services and web services of domains. The input file follows the format <alias>,<canonical>, where <alias> denotes the alias domain and <canonical> denotes the canonical domain. Run example: python3 detect_web_domain_status.py input.txt. By running detect_web_domain_status.py on the domain name list, you can get Table 4 and Table 5 in the paper. Due to ethical reasons, we only provide sample input data, not full domain name datasets. The cname_chain directory contains a dataset of CNAME relationships for popular domains and their subdomains. The file top-1m_sld_cname.csv includes CNAME mappings for second-level domains (SLDs), while top-1m_subdomain_cname.csv includes CNAME mappings for subdomains. Each line in these files follows the format <alias>,<canonical>, where <alias> is the alias domain and <canonical> is the canonical domain. The file cname_chain.ipynb is the code for analyzing CNAME chains, and the result corresponds to Table 1. The plot directory contains the code and corresponding data used to generate the figures in the paper. plot_query_traffic.py is used to generate Figure 7, and plot_lifetime.py is used to generate Figure 8. The DNS_resolvers_test folder contains the code used for testing DNS resolvers, as well as the list of DNS resolvers, corresponding to Table 3. The domain_type folder contains the code and results for querying domain types, corresponding to Table 6.