kind,id,name,concept,observed_by_domainsproject,source,time_resolution,note
stage,01,Registration,,no,none (no WHOIS or zone-file registration dates in this study),,11.5-14.0% of each cohort was already present in the previous month's NS crawl so first observation is not always a new registration
stage,02,First observation,Observation,yes,Newly Observed Hostnames daily deltas (Dec 24 2024 - Sep 27 2026),daily,first day any hostname under the registered domain appeared; 29.2M distinct domains in the July and August cohorts (first observed May-Jul 2026)
stage,03,DNS activation,Activation,yes,monthly A (web) MX and NS crawls; weekly A/MX/NS probes of the 857 lookalikes,monthly snapshot (weekly for the 857),recorded as a posture class: parked / live MX (self-hosted or third-party) / resolving no MX / dark / not crawled
stage,04,Infrastructure deployment,Weaponization,no,none,,DNS shows which network answers a query but not what it serves (site certificate phishing kit or payload)
stage,05,Abuse,Weaponization,no,none,,phishing or malware served or lures sent; start time unknown outside the campaign
stage,06,Feed discovery,Discovery (outcome),yes,OpenPhish public-feed git history; URLhaus dateadded,12-hour (OpenPhish since Jun 2025); URLhaus date added,a third party's record of discovered web abuse; web-only; a fraction of all abuse; URLhaus coverage complete from Jun 24 2026
transition,01-02,Registration -> First observation,,no,,,lag from registration to first sighting unknown
transition,02-03,First observation -> DNS activation,,partly,monthly crawls,monthly,state at the next crawl is seen but not the day it changed
transition,03-04,DNS activation -> Infrastructure deployment,,no,,,no view of what the host serves
transition,04-05,Infrastructure deployment -> Abuse,,no,,,no view of when abuse starts
transition,05-06,Abuse -> Feed discovery,,no,,,the feed's detection lag is unknown
measurement,clock,The clock: first observation -> feed discovery,,yes (endpoints only),NOH deltas x OpenPhish + URLhaus,days,July cohort: 53.7% of 6782 listings within 3 days of first observation; 79-89% of each cohort's listings came before its posture crawl
measurement,posture_test,The posture test: DNS activation state -> later feed discovery,,yes (endpoints only),monthly crawls x OpenPhish + URLhaus,crawl date to Sep 27 2026,risk set = domains still unlisted when posture was measured; Mantel-Haenszel adjusted risk ratios