Gollector: Measuring Domain Name Dark Matter from Different Vantage Points

Kaspar Hageman*, René Rydhof Hansen, Jens Myrup Pedersen

*Corresponding author for this work

Research output: Contribution to book/anthology/report/conference proceedingArticle in proceedingResearchpeer-review

1 Citation (Scopus)


This paper proposes Gollector, a novel tool for measuring the domain name space from different vantage points. Whereas such measurements have typically been conducted from a single (or few) vantage point, our proposed solution combines multiple measurements in a single system. Gollector allows us to express the relative difference in the covered domain name space, and the temporal characteristics, as domain name dark matter. We leverage a three-week trace from four vantage points, by applying the tool to three security-related use cases: early domain registration detection, data leakage in a split-horizon situation, and a proposed method for subdomain enumeration. We release the Gollector source code to the research community to support future research in this field.

Original languageEnglish
Title of host publicationSecure IT Systems : 26th Nordic Conference, NordSec 2021, Virtual Event, November 29–30, 2021, Proceedings
EditorsNicola Tuveri, Antonis Michalas, Billy Bob Brumley
Number of pages20
Publication date2021
ISBN (Print)978-3-030-91624-4
ISBN (Electronic)978-3-030-91625-1
Publication statusPublished - 2021
Event26th Nordic Conference on Secure IT Systems, NordSec 2021 - Virtual, Online
Duration: 29 Nov 202130 Nov 2021


Conference26th Nordic Conference on Secure IT Systems, NordSec 2021
CityVirtual, Online
SeriesLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume13115 LNCS

Bibliographical note

Publisher Copyright:
© 2021, Springer Nature Switzerland AG.


  • DNS
  • Domain names
  • Measurements
  • TLS


Dive into the research topics of 'Gollector: Measuring Domain Name Dark Matter from Different Vantage Points'. Together they form a unique fingerprint.

Cite this