Dangling Domains: Security Threats, Detection and Prevalence
Summary: Palo Alto Networks' Unit 42 built a detector for dangling DNS records and found 317,000 unsafe dangling domains in its passive DNS data, with 63.1% stemming from expired rdata and 36.9% from GitHub. The count includes 13 domains under the gov TLD, 197 under edu, and 4,767 under the Tranco top 2,000, and the detector checks every valid record every few weeks plus daily checks of records queried in the past day.
Key Takeaway: Attackers can claim these records at low cost while the whois information stays the same and subdomains inherit the reputation of well-known parents, so 4,767 dangling domains under the Tranco top 2,000 are positioned to make phishing and scams far harder for users and automated detectors to spot.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026