{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2026:Y2VJ5OLMISTDNYPBAUW7GVR73Y","short_pith_number":"pith:Y2VJ5OLM","schema_version":"1.0","canonical_sha256":"c6aa9eb96c44a636e1e1052df3563fde0a03823a3d1fc10d44209ee71519764c","source":{"kind":"arxiv","id":"2603.21652","version":2},"attestation_state":"computed","paper":{"title":"TLS Certificate and Domain Feature Analysis of Phishing Domains in the Danish .dk Namespace","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Athanasios P. Pelekoudas, Christian H. Reichkendler, Epameinondas Bolis, Jasmin Lindner, Johannes T. E. Hansen, Mathias Davidsen, Prodromos Kyriakidis, Sajad Homayoun","submitted_at":"2026-03-23T07:30:05Z","abstract_excerpt":"Phishing attacks remain a persistent cybersecurity threat, and the widespread adoption of TLS certificates has unintentionally enabled malicious websites to appear trustworthy to users. This study examines whether certificate metadata and domain characteristics can help distinguish phishing domains from benign domains within the Danish .dk namespace. A dataset was constructed by combining registry information from Punktum dk with phishing reports and popularity rankings from external sources. TLS certificate attributes were collected using Netlas, while additional domain-based features were de"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2603.21652","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-23T07:30:05Z","cross_cats_sorted":[],"title_canon_sha256":"6c825e663f1ab109c06103c4629fcb7c5ed85055faa4fc07d7cff79fd9782dbb","abstract_canon_sha256":"448d35f569d8c17928a89e00e963665e9e1aca90ff5f8b6c0a6af1ecfcde21f6"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-20T00:05:43.764125Z","signature_b64":"U45UrsmFO3/QV6oUaHEokEaoLV5Bp6d9RVNRhUYpyDuEZBycVmXkwY88G3Wh/yyEmE/R33zn1qfQODvBrw1XAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c6aa9eb96c44a636e1e1052df3563fde0a03823a3d1fc10d44209ee71519764c","last_reissued_at":"2026-05-20T00:05:43.763540Z","signature_status":"signed_v1","first_computed_at":"2026-05-20T00:05:43.763540Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"TLS Certificate and Domain Feature Analysis of Phishing Domains in the Danish .dk Namespace","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Athanasios P. Pelekoudas, Christian H. Reichkendler, Epameinondas Bolis, Jasmin Lindner, Johannes T. E. Hansen, Mathias Davidsen, Prodromos Kyriakidis, Sajad Homayoun","submitted_at":"2026-03-23T07:30:05Z","abstract_excerpt":"Phishing attacks remain a persistent cybersecurity threat, and the widespread adoption of TLS certificates has unintentionally enabled malicious websites to appear trustworthy to users. This study examines whether certificate metadata and domain characteristics can help distinguish phishing domains from benign domains within the Danish .dk namespace. A dataset was constructed by combining registry information from Punktum dk with phishing reports and popularity rankings from external sources. TLS certificate attributes were collected using Netlas, while additional domain-based features were de"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2603.21652","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2603.21652/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2603.21652","created_at":"2026-05-20T00:05:43.763625+00:00"},{"alias_kind":"arxiv_version","alias_value":"2603.21652v2","created_at":"2026-05-20T00:05:43.763625+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2603.21652","created_at":"2026-05-20T00:05:43.763625+00:00"},{"alias_kind":"pith_short_12","alias_value":"Y2VJ5OLMISTD","created_at":"2026-05-20T00:05:43.763625+00:00"},{"alias_kind":"pith_short_16","alias_value":"Y2VJ5OLMISTDNYPB","created_at":"2026-05-20T00:05:43.763625+00:00"},{"alias_kind":"pith_short_8","alias_value":"Y2VJ5OLM","created_at":"2026-05-20T00:05:43.763625+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y","json":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y.json","graph_json":"https://pith.science/api/pith-number/Y2VJ5OLMISTDNYPBAUW7GVR73Y/graph.json","events_json":"https://pith.science/api/pith-number/Y2VJ5OLMISTDNYPBAUW7GVR73Y/events.json","paper":"https://pith.science/paper/Y2VJ5OLM"},"agent_actions":{"view_html":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y","download_json":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y.json","view_paper":"https://pith.science/paper/Y2VJ5OLM","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2603.21652&json=true","fetch_graph":"https://pith.science/api/pith-number/Y2VJ5OLMISTDNYPBAUW7GVR73Y/graph.json","fetch_events":"https://pith.science/api/pith-number/Y2VJ5OLMISTDNYPBAUW7GVR73Y/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/action/timestamp_anchor","attest_storage":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/action/storage_attestation","attest_author":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/action/author_attestation","sign_citation":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/action/citation_signature","submit_replication":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/action/replication_record"}},"created_at":"2026-05-20T00:05:43.763625+00:00","updated_at":"2026-05-20T00:05:43.763625+00:00"}