Jon Oberheide Manish Karir Zhuoqing Morley Mao Characterizing Dark DNS Behavior. 140-156 2007 conf/dimva/2007 DIMVA http://dx.doi.org/10.1007/978-3-540-73614-1_9 db/conf/dimva/dimva2007.html#OberheideKM07