{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:OQSGTUMLO4LXWZ7HL5EWCBTN47","short_pith_number":"pith:OQSGTUML","canonical_record":{"source":{"id":"2111.00142","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-10-30T02:04:56Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"84f2646fe5ee0f4cd4e9e038d289bf997aac39079ee4fd80099cded139a5e76c","abstract_canon_sha256":"75c5110e3ecdecde499e0f5941cb03bd69226a995912e2e6faeaea58bf62eb32"},"schema_version":"1.0"},"canonical_sha256":"742469d18b77177b67e75f4961066de7e10cfb78611b06f8bdf1983de68e6c34","source":{"kind":"arxiv","id":"2111.00142","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2111.00142","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"arxiv_version","alias_value":"2111.00142v2","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2111.00142","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"pith_short_12","alias_value":"OQSGTUMLO4LX","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"pith_short_16","alias_value":"OQSGTUMLO4LXWZ7H","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"pith_short_8","alias_value":"OQSGTUML","created_at":"2026-07-05T03:35:33Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:OQSGTUMLO4LXWZ7HL5EWCBTN47","target":"record","payload":{"canonical_record":{"source":{"id":"2111.00142","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-10-30T02:04:56Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"84f2646fe5ee0f4cd4e9e038d289bf997aac39079ee4fd80099cded139a5e76c","abstract_canon_sha256":"75c5110e3ecdecde499e0f5941cb03bd69226a995912e2e6faeaea58bf62eb32"},"schema_version":"1.0"},"canonical_sha256":"742469d18b77177b67e75f4961066de7e10cfb78611b06f8bdf1983de68e6c34","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T03:35:33.754405Z","signature_b64":"lNLcEa25y7W2PEkHNiSJfF3UVG3HpnEIx233hShKe0Gj3sGWvEEZpL62HlGmrpSThzWSRvD3/fIK71JBCT2gBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"742469d18b77177b67e75f4961066de7e10cfb78611b06f8bdf1983de68e6c34","last_reissued_at":"2026-07-05T03:35:33.753889Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T03:35:33.753889Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2111.00142","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:35:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ELurPwNkN9nvjG98VwmCsrJmEBZ4VG+/rp8AosAiBkhtKhoaByr907Wlp1qEsFF5V9FnH7XU44iysi+Q/r5SCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T15:56:12.354944Z"},"content_sha256":"ee86839161fc91404bf4d87d18a93ed74d76d3ffca0cc2f08c4279573eaeb119","schema_version":"1.0","event_id":"sha256:ee86839161fc91404bf4d87d18a93ed74d76d3ffca0cc2f08c4279573eaeb119"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:OQSGTUMLO4LXWZ7HL5EWCBTN47","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Uncovering IP Address Hosting Types Behind Malicious Websites","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CR","authors_text":"Chamath Keppitiyagama, Kasun De Zoysa, Kenneth Thilakaratne, Mohamed Nabeel, Nimesha Wickramasinghe","submitted_at":"2021-10-30T02:04:56Z","abstract_excerpt":"Hundreds of thousands of malicious domains are created everyday. These malicious domains are hosted on a wide variety of network infrastructures. Traditionally, attackers utilize bullet proof hosting services (e.g. MaxiDed, Cyber Bunker) to take advantage of relatively lenient policies on what content they can host. However, these IP ranges are increasingly being blocked or the services are taken down by law enforcement. Hence, attackers are moving towards utilizing IPs from regular hosting providers while staying under the radar of these hosting providers. There are several practical advantag"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2111.00142","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2111.00142/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T03:35:33Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"3gDdNw/iTJT53tWXwm5wNjgPUo3hL7j0/0dXcEvwfkBYRum7EjIn1WypOUKcpCyA8UfLD02FmI0A/j0fNIQTCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T15:56:12.356212Z"},"content_sha256":"84e543e068165251a49dcb627d98af17b5c883bbba549099abd00a41791aaeea","schema_version":"1.0","event_id":"sha256:84e543e068165251a49dcb627d98af17b5c883bbba549099abd00a41791aaeea"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/OQSGTUMLO4LXWZ7HL5EWCBTN47/bundle.json","state_url":"https://pith.science/pith/OQSGTUMLO4LXWZ7HL5EWCBTN47/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/OQSGTUMLO4LXWZ7HL5EWCBTN47/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-11T15:56:12Z","links":{"resolver":"https://pith.science/pith/OQSGTUMLO4LXWZ7HL5EWCBTN47","bundle":"https://pith.science/pith/OQSGTUMLO4LXWZ7HL5EWCBTN47/bundle.json","state":"https://pith.science/pith/OQSGTUMLO4LXWZ7HL5EWCBTN47/state.json","well_known_bundle":"https://pith.science/.well-known/pith/OQSGTUMLO4LXWZ7HL5EWCBTN47/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:OQSGTUMLO4LXWZ7HL5EWCBTN47","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"75c5110e3ecdecde499e0f5941cb03bd69226a995912e2e6faeaea58bf62eb32","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-10-30T02:04:56Z","title_canon_sha256":"84f2646fe5ee0f4cd4e9e038d289bf997aac39079ee4fd80099cded139a5e76c"},"schema_version":"1.0","source":{"id":"2111.00142","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2111.00142","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"arxiv_version","alias_value":"2111.00142v2","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2111.00142","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"pith_short_12","alias_value":"OQSGTUMLO4LX","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"pith_short_16","alias_value":"OQSGTUMLO4LXWZ7H","created_at":"2026-07-05T03:35:33Z"},{"alias_kind":"pith_short_8","alias_value":"OQSGTUML","created_at":"2026-07-05T03:35:33Z"}],"graph_snapshots":[{"event_id":"sha256:84e543e068165251a49dcb627d98af17b5c883bbba549099abd00a41791aaeea","target":"graph","created_at":"2026-07-05T03:35:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2111.00142/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Hundreds of thousands of malicious domains are created everyday. These malicious domains are hosted on a wide variety of network infrastructures. Traditionally, attackers utilize bullet proof hosting services (e.g. MaxiDed, Cyber Bunker) to take advantage of relatively lenient policies on what content they can host. However, these IP ranges are increasingly being blocked or the services are taken down by law enforcement. Hence, attackers are moving towards utilizing IPs from regular hosting providers while staying under the radar of these hosting providers. There are several practical advantag","authors_text":"Chamath Keppitiyagama, Kasun De Zoysa, Kenneth Thilakaratne, Mohamed Nabeel, Nimesha Wickramasinghe","cross_cats":["cs.LG"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-10-30T02:04:56Z","title":"Uncovering IP Address Hosting Types Behind Malicious Websites"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2111.00142","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:ee86839161fc91404bf4d87d18a93ed74d76d3ffca0cc2f08c4279573eaeb119","target":"record","created_at":"2026-07-05T03:35:33Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"75c5110e3ecdecde499e0f5941cb03bd69226a995912e2e6faeaea58bf62eb32","cross_cats_sorted":["cs.LG"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-10-30T02:04:56Z","title_canon_sha256":"84f2646fe5ee0f4cd4e9e038d289bf997aac39079ee4fd80099cded139a5e76c"},"schema_version":"1.0","source":{"id":"2111.00142","kind":"arxiv","version":2}},"canonical_sha256":"742469d18b77177b67e75f4961066de7e10cfb78611b06f8bdf1983de68e6c34","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"742469d18b77177b67e75f4961066de7e10cfb78611b06f8bdf1983de68e6c34","first_computed_at":"2026-07-05T03:35:33.753889Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T03:35:33.753889Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"lNLcEa25y7W2PEkHNiSJfF3UVG3HpnEIx233hShKe0Gj3sGWvEEZpL62HlGmrpSThzWSRvD3/fIK71JBCT2gBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T03:35:33.754405Z","signed_message":"canonical_sha256_bytes"},"source_id":"2111.00142","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:ee86839161fc91404bf4d87d18a93ed74d76d3ffca0cc2f08c4279573eaeb119","sha256:84e543e068165251a49dcb627d98af17b5c883bbba549099abd00a41791aaeea"],"state_sha256":"da19d94288b85cfaa72914791034b7cf3314fd4451a664e0dee83020fc9c56d9"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"WcrjI1fJfu7mwdHgZPb68Y6dH1P3XXou+1CdkuKfHausI9KzD9PY+FITVSXmngACHc4c8EMPp2U4TwLLSGIFDA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-11T15:56:12.362357Z","bundle_sha256":"6c265b5de714612891980d1efe7024243b425610e8c9d16f1b990f4e032ce80c"}}