Newly Registered Domains: Malicious Abuse by Bad Actors
Summary: Palo Alto Networks' Unit 42, tracking newly registered domains for more than nine years, reports that over 70% of NRDs are classified malicious, suspicious, or not safe for work by its PAN-DB URL Filtering service - nearly 10 times the 7.6% ratio seen in Alexa's top 10,000 domains. The unit's system identifies roughly 200,000 NRDs per day, and its case studies show domains used for AzoRult command and control, Emotet payload delivery, Netflix credential phishing, and typosquatting within days of registration.
What's compelling: Most malicious NRDs live only hours or a couple of days - the AzoRult C2 domain soroog[.]xyz was used the same day it was registered and went non-existent after June 26, 2019 - so detection that waits for a vendor verdict often arrives after the domain is already gone.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026