Automatically Detecting DNS Hijacking in Passive DNS
Summary: Unit 42's machine learning pipeline processed over 29 billion new DNS records between March 27 and September 21, 2024, extracting 74 features from more than 169 terabytes of passive DNS and geolocation data and identifying 6,729 records as DNS hijacking, an average of 38 per day. Detected examples include two domains of a large U.S. utility management company and an ISP's A record both pointed to 176.9.24[.]28 in May 2024, and the Hungarian opposition party domain dkujpest[.]hu resolving to a new German IP address on Jan. 28, 2024.
What's compelling: The pipeline screens roughly 3.3 million candidate records daily to surface about 38 confirmed hijacks, and the same IP address 176.9.24[.]28 was used against both a major U.S. utility management company and one of the largest ISPs, showing a single actor can reach across sectors.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026