Strategically Aged Domain Detection: Capture APT Attacks With DNS Traffic Trends
Summary: Palo Alto Networks' Unit 42 describes a cloud-based detector that extracts about 30,000 domains daily from passive DNS data and flags those that stay dormant for months to years before gaining more than 10.3 times their traffic within one day. The SolarWinds C2 domain avsvmcloud[.]com, registered in 2018, stayed dormant for two years before attack traffic began in March 2020, when its passive DNS traffic rose about 165 times.
Why it matters: These aged domains carry a malicious rate more than three times that of newly registered domains, and 22.27% are malicious, suspicious or not safe for work - so a domain's clean history is not evidence of safety.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026