Network Abuses Leveraging High-Profile Events: Suspicious Domain Registrations and Other Scams
Summary: Unit 42 detected over 200,000 newly registered domains daily and found that in the year from October 2023 through September 2024, Olympic-related registrations averaged seven per day before tripling during event weeks, with 16% of those domains deemed suspicious - 13 times the general NRD rate. On the July 26, 2024 opening ceremony day, 20% of newly registered domains with Olympic keywords were flagged suspicious, and 27% of domains containing 'aoyunhui' were flagged.
Bottom line: A single actor appears to sit behind this: 23 Olympic domains from Tokyo 2021 and Paris 2024 shared naming conventions and resolved IPs such as 3.64.163[.]50 and 76.223.67[.]189, meaning infrastructure built for one event was reused for the next - and 52% of the suspicious domains used .com, the TLD your users trust most.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026