Subdomain Reputation: Detecting Malicious Subdomains of Public Apex Domains
Summary: Palo Alto Networks describes a detector for malicious subdomains of public apex domains, where WHOIS, nameserver and IP reputation data do not apply because providers such as No-IP, FreeDNS, GitHub Pages and Netlify let many unrelated users claim subdomains under their registered domains. The system identifies an average of over 300 new subdomains per day across a half dozen public apex domains, including duckdns[.]org subdomains used by the Roaming Mantis group in an SMS phishing campaign that installs MoqHao on Android and steals credentials from iPhone users.
What's compelling: In a day of Palo Alto Networks passive DNS data, github[.]io, netlify[.]app and ddns[.]net each carried more subdomains than 93% of top-level domains had registered domains, so a single abused provider can put attacker-controlled infrastructure on a domain your allowlists may already trust.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026