Classification of Compromised versus Maliciously Registered Domains: Difference between revisions

Classification of COmpromised versus Maliciously Registered domains ('''COMAR''') is a joint research project with the goal of using machine learning to classify types of domain exploitation.<ref>[https://www.sidnlabs.nl/en/news-and-blogs/distinguishing-exploited-from-malicious-domain-names-using-comar Distinguishing between Malicious and Compromised Domains, SIDN Labs Blog]</ref> It is led by [[SIDN]] Labs, [[AFNIC]] Labs, and Grenoble Alps University (GAU). The Franco-Dutch project distinguishes ''automatically'' between domain names registered by cybercriminals for the purpose of malicious activities and domain names exploited through vulnerable web applications. The project is designed to help intermediaries, such as [[registrars]] and [[ccTLD]] [[registries]], optimize their anti-[[DNS Abuse|abuse]] processes.<ref>[https://comar-project.univ-grenoble-alpes.fr/ COMAR, Grenoble Alpes Uni]</ref> A [[malicious Domain|domain name classified as maliciously registered]] should be blocked by the registry or registrar, by removing the name from the zone file. A [[compromised Domain|legitimate but compromised domain]] name should not be blocked. Instead, just the malicious content should be removed by the hosting provider or domain owner ([[registrant]]).<ref>[https://comar-project.univ-grenoble-alpes.fr/ COMAR Project, GAU]</ref>