TLD Tracker: Exploring Newly Released Top-Level Domains
Summary: Unit 42 investigated 19 top-level domains released in the past year and found large-scale phishing campaigns, distribution of potentially unwanted programs, torrenting sites, and pranking and meme campaigns. One cluster of 112 domains under new TLDs shared four nameservers on the same IP addresses and one registrar, mostly registered from June to November 2023, and all redirected to paths under choto[.]xyz that led to gambling sites.
Why it matters: Unit 42 reports it was first to detect and block over 78% of those 112 domains, meaning the rest were live for others to reach, and a separate cluster of 92 .bot domains was registered within a two-week window just five weeks after .bot entered general availability.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026