Security Report · raw.githubusercontent.com

DNSFilter’s 2026 Security Report Finds 30% Growth in Detected Threats

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

DNSFilter’s 2026 report analyzes over 52 trillion DNS queries from October 2024–September 2025. It reports 30% growth in identified threats, increased daily threat-query volume, and seasonal phishing targeting shoppers, travelers, and job seekers.

Key points

DNSFilter reports that identified threats grew 30% between October 2024 and September 2025; average daily threat-query volume increased 21.81% compared with the previous reporting period.
Malicious requests averaged 0.66% of monthly queries, peaking at 1.02% in January 2025. Malicious domains averaged 3.78% of unique domains observed.
The estimated 66 daily threat encounters per user assumes 10,000 DNS requests, twice the previous report’s assumption. Using the previous 5,000-request baseline, estimated encounters increased nearly 14%.
Analysis of 11,343 Tycoon 2FA fully qualified domain names found that 99.6% of subdomains received fewer than 10 queries, suggesting campaign- or target-specific generation rather than broad distribution.
A fake CAPTCHA associated with Lumma Stealer prompted users to copy and paste commands. DNSFilter recorded 23 interactions over three days; 17% completed the steps, triggering attempted payload delivery.
Between April and October 2025, researchers identified 8,724 malicious domains containing “jobs” and 1,161 containing “careers”; 88% of malicious hiring-keyword domains were newly registered or newly observed.
The report links phishing spikes to shopping, travel, sports, tax deadlines, and insurance enrollment, and recommends incorporating seasonal patterns and newly observed domains into proactive security controls.

Article Details

Publisher: DNSFilter
Report Period: 2024-10 to 2025-09; selected observations extend through 2025-12
Scope: DNSFilter network DNS telemetry, malicious-domain activity, regional traffic, filtering policies, and selected phishing and malware investigations.
Sample Size: Over 52 trillion DNS queries during the primary reporting period.
Key Statistics: DNSFilter reports that identified threats on its network grew 30% between October 2024 and September 2025.
Malicious requests averaged 0.66% of monthly queries during the reporting period, peaking at 1.02% in January 2025.
Average daily threat-query volume increased 21.81% compared with the previous reporting period.
The estimated average user encounters 66 threats daily, assuming 10,000 daily DNS requests. At the previous report's assumption of 5,000 requests, the estimated increase would be nearly 14%.
In one fake CAPTCHA investigation, DNSFilter observed 23 interactions over three days; 17% of people encountering the prompt completed its copy-and-paste steps, resulting in attempted malware delivery.
Recommendations: Establish clear GenAI policies, maintain visibility into tool usage, and block tools when necessary for IT governance.
Use network-specific visibility into malicious domains and ccTLD activity to inform timely blocking decisions.
During major outages, combine real-time blocking of emerging threats with user-behavior visibility and internal security training.
Incorporate seasonal scam activity and newly observed domains into proactive security measures.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`recaptcha-manual[.]shop`	Domain associated with the Lumma Stealer fake CAPTCHA; it loaded outside the browser after users followed the prompted commands.
HOSTNAME	`human-verify-7u[.]pages[.]dev`	Specific Cloudflare Pages site associated with the malicious fake CAPTCHA delivering Lumma Stealer; it displayed an error after the user clicked the verification prompt.