After the Takedown: Excavating Abuse Infrastructure with DNS Sinkholes

A methodological analysis of how DNS sinkholes preserve abuse infrastructure at the moment of takedown, enabling post-hoc reconstruction using passive DNS data.