Phishing Detection Using Various Parts Of DNS Ecosystem

Phishing and fraud together made up about 95% of the roughly 98,000 incidents the Polish national CERT recorded in 2024. The speakers described the national response: a manually verified warning list of malicious domains that major Polish providers apply, and a detection system built on data from the .pl registry. After phishing registrations dropped, that registry-based model roughly doubled its detections, though it still caught only about 30% of listed domains. They reported that around 20% of its detections were not found by other methods, and that it was usually faster at spotting domains.

The middle of the talk moved to DNS resolver query streams, covering traffic across Europe under the DNS4EU project. The pipeline filtered out popular domains using allowlists, scored the remaining names with a fastText model and then a LLaMA-based embedding classifier, and grouped domains that clients queried close together in time to find related infrastructure. On a three-hour sample of about 31 million queries, the team found roughly 31,000 unique suspected phishing domains. A random check of 800 of them against VirusTotal found that more than half were already flagged. Open challenges included class imbalance across top-level domains in training data, automating graph review, handling streaming volume, and verifying detections when only a domain name is available.

The closing lessons were that registry-based detection depends on a steady supply of phishing, that TLD server data is underused, and that simple regex and keyword hunting remains valuable alongside machine learning. Results are feeding the DNS4EU threat feed and the Polish warning list, while the other methods are moving toward production.