@article{dmarcDalChecco,
title={{DMARC Compliance Spoofing}},
author={Dal Checco, Paolo},
year={2025},
url = {https://www.dalchecco.it/dmarcforensics-dmarc-compliance-spoofing/},
journal = {}
}

@techreport{IC3gov,
    author = {Federal Bureau of Investigation},
    title = {{2024 Internet Crime Report}},
    institution = {Internet Crime Complaint Center},
    year = {2024},
    url = {https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf}
}

@misc{rfc5321,
    series =    {Request for Comments},
    number =    5321,
    howpublished =  {RFC 5321},
    publisher = {RFC Editor},
    doi =       {10.17487/RFC5321},
    url =       {https://www.rfc-editor.org/info/rfc5321},
    author =    {Dr. John C. Klensin},
    title =     {{Simple Mail Transfer Protocol}},
    pagetotal = 95,
    year =      2008,
    month =     oct,
    abstract =  {This document is a specification of the basic protocol for Internet electronic mail transport. It consolidates, updates, and clarifies several previous documents, making all or parts of most of them obsolete. It covers the SMTP extension mechanisms and best practices for the contemporary Internet, but does not provide details about particular extensions. Although SMTP was designed as a mail transport and delivery protocol, this specification also contains information that is important to its use as a "mail submission" protocol for "split-UA" (User Agent) mail reading systems and mobile environments. {[}STANDARDS-TRACK{]}},
}


@article{indianFraud,
	author = {Mihir Tanksale},
	title = {{Cops save firm’s money lost in email spoofing fraud}},
	institution = {The Times of India},
	year = {2025},
	url = {https://timesofindia.indiatimes.com/city/pune/cops-save-firms-money-lost-in-email-spoofing-fraud/articleshow/123312588.cms}
}

@article{austrianFraud,
	author ={Reuters},
	title = {{Austria's FACC, hit by cyber fraud, fires CEO}},
	institution = {Reuters},
	year = {2016},
	url = {https://www.reuters.com/article/us-facc-ceo-idUSKCN0YG0ZF/}
}

@article{ubiquitiNetworks,
  author       = {{Krebs on Security}},
  title        = {{Tech Firm Ubiquiti Suffers 46M Cyberheist}},
  year         = {2015},
  url          = {https://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheist/},
  urldate      = {2026-01-29}
}


@misc{rfc7208,
    series =    {Request for Comments},
    number =    7208,
    howpublished =  {RFC 7208},
    publisher = {RFC Editor},
    doi =       {10.17487/RFC7208},
    url =       {https://www.rfc-editor.org/info/rfc7208},
    author =    {Scott Kitterman},
    title =     {{Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1}},
    pagetotal = 64,
    year =      2014,
    month =     apr,
    abstract =  {Email on the Internet can be forged in a number of ways. In particular, existing protocols place no restriction on what a sending host can use as the "MAIL FROM" of a message or the domain given on the SMTP HELO/EHLO commands. This document describes version 1 of the Sender Policy Framework (SPF) protocol, whereby ADministrative Management Domains (ADMDs) can explicitly authorize the hosts that are allowed to use their domain names, and a receiving host can check such authorization. This document obsoletes RFC 4408.},
}

@misc{rfc6376,
    series =    {Request for Comments},
    number =    6376,
    howpublished =  {RFC 6376},
    publisher = {RFC Editor},
    doi =       {10.17487/RFC6376},
    url =       {https://www.rfc-editor.org/info/rfc6376},
    author =    {Murray Kucherawy and Dave Crocker and Tony Hansen},
    title =     {{DomainKeys Identified Mail (DKIM) Signatures}},
    pagetotal = 76,
    year =      2011,
    month =     sep,
    abstract =  {DomainKeys Identified Mail (DKIM) permits a person, role, or organization that owns the signing domain to claim some responsibility for a message by associating the domain with the message. This can be an author's organization, an operational relay, or one of their agents. DKIM separates the question of the identity of the Signer of the message from the purported author of the message. Assertion of responsibility is validated through a cryptographic signature and by querying the Signer's domain directly to retrieve the appropriate public key. Message transit from author to recipient is through relays that typically make no substantive change to the message content and thus preserve the DKIM signature. This memo obsoletes RFC 4871 and RFC 5672. {[}STANDARDS-TRACK{]}},
}

@techreport{dmarcRFC,
    author = {M. Kucherawy, E. Zwicky},
    title = {{Domain-based Message Authentication, Reporting, and Conformance (DMARC)}},
    institution = {Yahoo!},
    year = {2013},
    url = {https://datatracker.ietf.org/doc/html/rfc7489#autoid-2}
}

@misc{rfc8601,
    series =    {Request for Comments},
    number =    8601,
    howpublished =  {RFC 8601},
    publisher = {RFC Editor},
    doi =       {10.17487/RFC8601},
    url =       {https://www.rfc-editor.org/info/rfc8601},
    author =    {Murray Kucherawy},
    title =     {{Message Header Field for Indicating Message Authentication Status}},
    pagetotal = 54,
    year =      2019,
    month =     may,
    abstract =  {This document specifies a message header field called "Authentication-Results" for use with electronic mail messages to indicate the results of message authentication efforts. Any receiver-side software, such as mail filters or Mail User Agents (MUAs), can use this header field to relay that information in a convenient and meaningful way to users or to make sorting and filtering decisions. This document obsoletes RFC 7601.},
}

@article{sandboxesmalware,
  title={{Prudent Practices for Designing Malware Experiments}},
  author={Rossow, C. et al.},
  journal={IEEE Security \& Privacy},
  year={2012},
  url={https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6234405}
}

@inproceedings{spearphishing,
  title={{Detecting Credential Spearphishing in Enterprise Settings}},
  author={Ho, Grant and Sharma, Ashish and Anderson, Ross and others},
  booktitle={USENIX Security Symposium},
  year={2016}
}

@inproceedings{juola2009jgaap,
  title={JGAAP: A system for comparative evaluation of authorship attribution},
  author={Juola, Patrick},
  booktitle={Journal of the Chicago Colloquium on Digital Humanities and Computer Science},
  year={2009}
}

@misc{splunk_docs,
  title={Splunk Enterprise Security Documentation},
  author={{Splunk Inc.}},
  year={2023},
  howpublished={Technical documentation},
  url ={https://docs.splunk.com/Documentation/ESCU}
}

@misc{elastic_docs,
  title={Elastic Security Documentation},
  author={{Elastic NV}},
  year={2023},
  howpublished={Technical documentation},
  url = {https://www.elastic.co/docs/solutions/security}
}

@article{dmarc_siem_pro,
author = {Brad Slavin},
title = {{8 Reasons to choose a DMARC report analyzer tool with real-time dashboards and alerts}},
journal = {DuoCircle},
year = {2025},
url={https://www.duocircle.com/dmarc/8-reasons-choose-dmarc-report-analyzer-real-time-dashboards-alerts}
}


@article{gdpr.eu,
    author = {Ben Wolford},
    title = {{How does the GDPR affect email?}},
    journal = {GDPR.eu},
    year = {2018},
    url = {https://gdpr.eu/email-encryption/}
}


@article{art82,
    author = {European Union},
    title = {{General Data Protection Regulation, Article 82}},
    journal = {GDPR.eu},
    year = {},
    url = {https://gdpr.eu/article-82-data-subjects-right-to-compensation-and-liability/}
}



@article{art32,
    author = {},
    title = {{General Data Protection Regulation, Article 32}},
    journal = {},
    year = {},
    url = {https://gdpr.eu/article-32-security-of-processing/}
}

@article{art5,
    author = {},
    title = {{General Data Protection Regulation, Article 5}},
    journal = {},
    year = {},
    url = {https://gdpr.eu/article-5-how-to-process-personal-data/}
}

@article{eprivacy,
    author = {},
    title = {{ePrivacy Regulation - article 16}},
    journal = {},
    year = {},
    url = {https://eprivacy-regulation.org/articles/chapter-iii/article-16-eprivacy-regulation-unsolicited-and-direct-marketing-communications}
}

@article{acn,
    author = {Agenzia per la Cybersicurezza Nazionale},
    title = {{Framework di Autenticazione per la Posta Elettronica}},
    journal = {ACN},
    year = {},
    url = {https://www.acn.gov.it/portale/documents/20119/1008330/Framework+di+Autenticazione+per+la+Posta+Elettronica.pdf/ac6e9bbe-247e-3fe2-85fa-997e6bd0809c?t=1755863999953}
}

@misc{nis2,
    author = {European Union},
    title = {{Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)}},
  howpublished = {\url{https://eur-lex.europa.eu/eli/dir/2022/2555/oj}},
  year = {2022},
  institution = {European Union},
  note = {Official Journal of the European Union, L 333, 27.12.2022, p. 80–152}
}




@misc{art21nis2,
    author = {European Union},
    title = {{Article 21 - NIS2 Directive}},
  year = {2022},
  institution = {European Union},
  url = {https://www.nis2-info.eu/article-21-cybersecurity-risk-management-measures/},
  note = {Official Journal of the European Union, L 333, 27.12.2022, p. 80–152}
}

@article{emailcompromise,
    author = {},
    title = {{Manipulated invoice via hacked e-mail: Those who do not encrypt are left holding the bag}},
    journal = {2b-Advice},
    year = {2025},
    url = {https://2b-advice.com/en/2025/03/07/manipulated-invoice-via-hacked-e-mail-those-who-do-not-encrypt-remain-liable-for-damages/#}
}

@article{emailcompromise2,
    author = {Cole J.N. Wilson},
    title = {{Email Fraud and Third-Party Hacks: Lessons From Recent Case Law}},
    journal = {McKercher},
    year = {2025},
    url = {https://www.mckercher.ca/en/news/posts/email-fraud-and-third-party-hacks-lessons-from-recent-case-law}
}

@article{dmarcadoption,
    author = {John Wilson},
    title = {{The State of Email Trust: Global DMARC Adoption Trends in Q2 2025}},
    journal = {Fortra Email Security},
    year = {2025},
    url = {https://emailsecurity.fortra.com/blog/dmarc-adoption-trends-q2-2025}
}

@article{aidetection,
	author = {Sanjay Ramdas Bauskar and Chandrakanth Rao Madhavaram and Eswar Prasad Galla and Janardhana Rao Sunkara and Hemanth Kumar Gollangi},
	title = {{AI-Driven Phishing Email Detection: Leveraging Big Data Analytics for Enhanced Cybersecurity}},
	journal = {Library Progress International},
	year = {2024},
	url = {https://bpasjournals.com/library-science/index.php/journal/article/view/1772}
}

@Article{mldetection,
	author = {Craig Beaman and Haruna Isah},
	title = {{Anomaly Detection in Emails using Machine Learning and Header Information}},
	journal = {arXiv.org},
	year = {2022},
	url = {https://arxiv.org/pdf/2203.10408}
}

@Article{kaspersky,
	author = {Roman Dedenok},
	title = {{How to repair DMARC}},
	journal = {kaspersky.com},
	year = {2020},
	url = {https://www.kaspersky.com/blog/how-to-cure-dmarc/36787/}
}


@Article{autorship,
	author = {Nishchal Sharma and Ajay Kumar},
	title = {{Deep Learning for Stylometry and Authorship Attribution: a Review of Literature}},
	journal = {International Journal for Research in Applied Science and Engineering Technology},
	year = {2024},
	url = {https://www.ijraset.com/research-paper/deep-learning-for-stylometry-and-authorship-attribution}
}

@Article{dmarcsiem,
author = {},
title = {{How SIEM Improves Phishing Detection and Prevention}},
journal = {SearchInform},
year = {},
url = {https://searchinform.com/articles/cybersecurity/measures/siem/use-cases/phishing-detection/}
}

@ARTICLE{blockchain_email,
  author={Hinarejos, M. Francisca and Ferrer-Gomila, Josep-Lluis and Huguet-Rotger, Llorenç},
  journal={IEEE Access}, 
  title={A Solution for Secure Certified Electronic Mail Using Blockchain as a Secure Message Board}, 
  year={2019},
  volume={7},
  number={},
  pages={31330-31341},
  keywords={Bitcoin;Blockchain;Electronic mail;Protocols;Bitcoin;blockchain;certified delivery;certified email;email security;fair exchange;nonrepudiation},
  doi={10.1109/ACCESS.2019.2902174}},
  url={https://ieeexplore.ieee.org/document/8654617}
}

@misc{blockchain,
author={González J.C. and García-Díaz V. and Núñez-Valdez E.R. et al.},
title={{Replacing email protocols with blockchain-based smart contracts}},
journal={Cluster Comput}, 
  year={2020},
  url={https://doi.org/10.1007/s10586-020-03128-9}
}


@Article{chainofcustody,
author = {Nick Gerda},
title = {{Charges Dropped in 67 Criminal Cases Due to Sheriff Evidence Mishandling}},
journal = {VOICE of OC},
year = {2021},
url = {https://voiceofoc.org/2021/01/charges-dropped-in-67-criminal-cases-due-to-sheriff-evidence-mishandling-da-reveals/}
}

@article{chainofcus,
author = {David Propper},
title = {{Colorado crime lab analyst faces over 100 charges for mishandling and altering reports}},
journal = {New York Post},
year = {2025},
url = {https://nypost.com/2025/01/23/us-news/yvonne-missy-woods-charged-after-alleged-crime-lab-misconduct/}
}

@article{spoofingpaper,
author={Kaiwen Shen and Chuhan Wang and Minglei Guo and Xiaofeng Zheng and Chaoyi Lu and Baojun Liu and Yuxuan Zhao and Shuang Hao and Haixin Duan and Qingfeng Pan and Min Yang},
title = {{Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks}},
journal = {USENIX Association 2021},
year = {2020},
url = {https://personal.utdallas.edu/~shao/papers/shen_usenix21.pdf}
}


@misc{powerdmarc,
	author={Milena Baghdasaryan},
	title={{PowerDMARC vs Suped: Choosing the Right Email Authentication Platform}},
	journal={PowerDMARC},
	year={2026},
	url={https://powerdmarc.com/suped-vs-powerdmarc/}	
}

@article{mxtoolboxvspowerdmarc,
	author={},
	title={{PowerDMARC vs MXtoolbox}},
	journal={Suped},
	year={},
	url={https://www.suped.com/compare/powerdmarc-vs-mxtoolbox}
}

@misc{unicodesec,
	author={Mark Davis and Michel Suignard},
	title={{Unicode Security Mechanisms}},
	journal={},
	year={2025},
	url={https://www.unicode.org/reports/tr39/}
}

