{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:Y2VJ5OLMISTDNYPBAUW7GVR73Y","short_pith_number":"pith:Y2VJ5OLM","canonical_record":{"source":{"id":"2603.21652","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-23T07:30:05Z","cross_cats_sorted":[],"title_canon_sha256":"6c825e663f1ab109c06103c4629fcb7c5ed85055faa4fc07d7cff79fd9782dbb","abstract_canon_sha256":"448d35f569d8c17928a89e00e963665e9e1aca90ff5f8b6c0a6af1ecfcde21f6"},"schema_version":"1.0"},"canonical_sha256":"c6aa9eb96c44a636e1e1052df3563fde0a03823a3d1fc10d44209ee71519764c","source":{"kind":"arxiv","id":"2603.21652","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2603.21652","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"arxiv_version","alias_value":"2603.21652v2","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2603.21652","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"pith_short_12","alias_value":"Y2VJ5OLMISTD","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"pith_short_16","alias_value":"Y2VJ5OLMISTDNYPB","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"pith_short_8","alias_value":"Y2VJ5OLM","created_at":"2026-05-20T00:05:43Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:Y2VJ5OLMISTDNYPBAUW7GVR73Y","target":"record","payload":{"canonical_record":{"source":{"id":"2603.21652","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-23T07:30:05Z","cross_cats_sorted":[],"title_canon_sha256":"6c825e663f1ab109c06103c4629fcb7c5ed85055faa4fc07d7cff79fd9782dbb","abstract_canon_sha256":"448d35f569d8c17928a89e00e963665e9e1aca90ff5f8b6c0a6af1ecfcde21f6"},"schema_version":"1.0"},"canonical_sha256":"c6aa9eb96c44a636e1e1052df3563fde0a03823a3d1fc10d44209ee71519764c","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-20T00:05:43.764125Z","signature_b64":"U45UrsmFO3/QV6oUaHEokEaoLV5Bp6d9RVNRhUYpyDuEZBycVmXkwY88G3Wh/yyEmE/R33zn1qfQODvBrw1XAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c6aa9eb96c44a636e1e1052df3563fde0a03823a3d1fc10d44209ee71519764c","last_reissued_at":"2026-05-20T00:05:43.763540Z","signature_status":"signed_v1","first_computed_at":"2026-05-20T00:05:43.763540Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2603.21652","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T00:05:43Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"MMKMNJ4wslBgyLsIO0z3ZLqQ11eYZSwiWl9El9Hdmr/UL8LUHr/o7Wlwuu5mnBtBeo0Ms7QOJVwfjrfTjUVjCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-05T15:16:45.178151Z"},"content_sha256":"83bb66398ea9432b4730a7c92fe979e69cb00addea15671b3f4264b4454caa94","schema_version":"1.0","event_id":"sha256:83bb66398ea9432b4730a7c92fe979e69cb00addea15671b3f4264b4454caa94"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:Y2VJ5OLMISTDNYPBAUW7GVR73Y","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"TLS Certificate and Domain Feature Analysis of Phishing Domains in the Danish .dk Namespace","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Athanasios P. Pelekoudas, Christian H. Reichkendler, Epameinondas Bolis, Jasmin Lindner, Johannes T. E. Hansen, Mathias Davidsen, Prodromos Kyriakidis, Sajad Homayoun","submitted_at":"2026-03-23T07:30:05Z","abstract_excerpt":"Phishing attacks remain a persistent cybersecurity threat, and the widespread adoption of TLS certificates has unintentionally enabled malicious websites to appear trustworthy to users. This study examines whether certificate metadata and domain characteristics can help distinguish phishing domains from benign domains within the Danish .dk namespace. A dataset was constructed by combining registry information from Punktum dk with phishing reports and popularity rankings from external sources. TLS certificate attributes were collected using Netlas, while additional domain-based features were de"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2603.21652","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2603.21652/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T00:05:43Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jeSRPXoMIgHLzU7m5qNSsjQTM2ybtVALixCfqyp7Je/N7xOpoz1vfhhy1YvnFw8YxjZC8TEXNpgslDrQbGidCA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-05T15:16:45.178552Z"},"content_sha256":"41488b8692f5cb75471b4cd38808c8ada9863d60b13610d5e23d75da52c0219c","schema_version":"1.0","event_id":"sha256:41488b8692f5cb75471b4cd38808c8ada9863d60b13610d5e23d75da52c0219c"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/bundle.json","state_url":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-05T15:16:45Z","links":{"resolver":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y","bundle":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/bundle.json","state":"https://pith.science/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/state.json","well_known_bundle":"https://pith.science/.well-known/pith/Y2VJ5OLMISTDNYPBAUW7GVR73Y/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:Y2VJ5OLMISTDNYPBAUW7GVR73Y","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"448d35f569d8c17928a89e00e963665e9e1aca90ff5f8b6c0a6af1ecfcde21f6","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-23T07:30:05Z","title_canon_sha256":"6c825e663f1ab109c06103c4629fcb7c5ed85055faa4fc07d7cff79fd9782dbb"},"schema_version":"1.0","source":{"id":"2603.21652","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2603.21652","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"arxiv_version","alias_value":"2603.21652v2","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2603.21652","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"pith_short_12","alias_value":"Y2VJ5OLMISTD","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"pith_short_16","alias_value":"Y2VJ5OLMISTDNYPB","created_at":"2026-05-20T00:05:43Z"},{"alias_kind":"pith_short_8","alias_value":"Y2VJ5OLM","created_at":"2026-05-20T00:05:43Z"}],"graph_snapshots":[{"event_id":"sha256:41488b8692f5cb75471b4cd38808c8ada9863d60b13610d5e23d75da52c0219c","target":"graph","created_at":"2026-05-20T00:05:43Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2603.21652/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Phishing attacks remain a persistent cybersecurity threat, and the widespread adoption of TLS certificates has unintentionally enabled malicious websites to appear trustworthy to users. This study examines whether certificate metadata and domain characteristics can help distinguish phishing domains from benign domains within the Danish .dk namespace. A dataset was constructed by combining registry information from Punktum dk with phishing reports and popularity rankings from external sources. TLS certificate attributes were collected using Netlas, while additional domain-based features were de","authors_text":"Athanasios P. Pelekoudas, Christian H. Reichkendler, Epameinondas Bolis, Jasmin Lindner, Johannes T. E. Hansen, Mathias Davidsen, Prodromos Kyriakidis, Sajad Homayoun","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-23T07:30:05Z","title":"TLS Certificate and Domain Feature Analysis of Phishing Domains in the Danish .dk Namespace"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2603.21652","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:83bb66398ea9432b4730a7c92fe979e69cb00addea15671b3f4264b4454caa94","target":"record","created_at":"2026-05-20T00:05:43Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"448d35f569d8c17928a89e00e963665e9e1aca90ff5f8b6c0a6af1ecfcde21f6","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-03-23T07:30:05Z","title_canon_sha256":"6c825e663f1ab109c06103c4629fcb7c5ed85055faa4fc07d7cff79fd9782dbb"},"schema_version":"1.0","source":{"id":"2603.21652","kind":"arxiv","version":2}},"canonical_sha256":"c6aa9eb96c44a636e1e1052df3563fde0a03823a3d1fc10d44209ee71519764c","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"c6aa9eb96c44a636e1e1052df3563fde0a03823a3d1fc10d44209ee71519764c","first_computed_at":"2026-05-20T00:05:43.763540Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-20T00:05:43.763540Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"U45UrsmFO3/QV6oUaHEokEaoLV5Bp6d9RVNRhUYpyDuEZBycVmXkwY88G3Wh/yyEmE/R33zn1qfQODvBrw1XAA==","signature_status":"signed_v1","signed_at":"2026-05-20T00:05:43.764125Z","signed_message":"canonical_sha256_bytes"},"source_id":"2603.21652","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:83bb66398ea9432b4730a7c92fe979e69cb00addea15671b3f4264b4454caa94","sha256:41488b8692f5cb75471b4cd38808c8ada9863d60b13610d5e23d75da52c0219c"],"state_sha256":"89e69a4d8ef455f9faeda5b11ce06ab3aa8598d2c6a1c13cca80028cbdacbf16"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"lIJahwSOSdGlDeGvJfqIZiXgQXoHpDsSjq9UJOCI4bXiQR+uzxDmDBWsCZ2gtkoFiAvKnavvR/T6lEYpBQ/ZCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-05T15:16:45.180664Z","bundle_sha256":"75064e38b8daee47da61831a0705bb000e8a849cfbcb2c8c651ccf8b0689a416"}}