Detecting and Preventing Malicious Domains Proactively with DNS Security
Summary: Palo Alto Networks Unit 42 built a proactive detector that flags malicious domains at registration time using WHOIS records, including registrar and name-server reputation, bulk registration clusters, and lexical cues like intimidating keywords or DGA-generated names. The system detected on average 500 malicious domains out of roughly 20,000 new registrations daily in December 2020, a 2.56% daily detection rate, and captured domains 9.25 days earlier on average than a public URL scanner while covering 4.28 times more malicious DNS traffic.
What you should know: The source reports that 62.31% of DNS queries to these malicious domains occur within the first 10 days of activation and only about 1% after 30 days, so a scanner that blocks just 8.23% of attack traffic on registration day leaves patient zero exposed during the window when attacks actually run.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026