Infoblox 2026 Threat Landscape Report Highlights Rapidly Rotating Cybercrime Infrastructure
Report discovered via Awesome Annual Security Reports.
Summary
Infoblox’s 2026 threat report says over 22% of 120 million newly registered domains showed threat characteristics. Its DNS analysis highlights short-lived infrastructure, industrialized fraud services, and expanding enterprise exposure.
Key points
- Between June 2025 and June 2026, Infoblox observed over 120 million newly registered domains; more than 22% were weaponized or exhibited threat characteristics.
- Infoblox reports that 88% of threat-related domains appeared in at most one environment, while 44% were active for only one day, limiting detection opportunities.
- Traffic distribution systems had the widest reported customer reach at 96%, helping attackers profile visitors, conceal malicious content, and deliver tailored lures.
- Scam-related domains increased approximately 62% year over year; the report describes specialized criminal services and AI-generated content supporting scalable fraud.
- In a 12-month analysis of customer phishing incidents, 71% of discovered phishing URLs lacked the impersonated brand name in their domains.
- Sixty-five percent of Infoblox Threat Defense Cloud customers queried residential proxy service domains, highlighting potential enterprise exposure to infrastructure that can conceal malicious traffic.
- The report recommends protective DNS, external threat monitoring, remediation of DNS misconfigurations, and current asset inventories to reduce infrastructure-related risks.
Article Details
- Publisher
- Infoblox
- Report Period
- June 2025–June 2026; frontline research covers July 2025–June 2026
- Scope
- DNS threat telemetry, cybercrime services, malicious infrastructure, evolving lures, and enterprise attack surfaces.
- Sample Size
- Trillions of DNS queries and over 120 million newly registered domains; customer population size not disclosed.
- Key Statistics
- More than 22% of over 120 million newly registered domains observed during the reporting period were weaponized or exhibited threat characteristics.
- 88% of threat-related domains were observed in at most one environment, and 44% were active for only one day.
- A 12-month analysis of individual customer phishing incidents found that 71% of discovered phishing URLs did not include the impersonated brand name in their domains.
- During a four-month study beginning in October 2025, researchers identified approximately 15,500 domains linked to malicious Keitaro deployments; more than 9,000 were registered specifically for the campaigns.
- Infoblox identified more than 5.3 billion unique leaked credentials and 373,000 brand abuse incidents.
- Recommendations
- Use DNS intelligence to identify and automatically block malicious and suspicious domains with little or no legitimate business purpose.
- Correlate external threat infrastructure and use automated takedowns to remove phishing, impersonation, and other malicious content.
- Continuously discover internet-facing assets and prioritize high-risk vulnerabilities and DNS misconfigurations, including dangling CNAMEs and lame delegations.
- Combine DNS telemetry with network and cloud visibility to maintain current asset and application inventories, including unmanaged assets and unapproved AI usage.
MITRE ATT&CK
T1071.004 · DNSDetour Dog uses DNS TXT requests and responses for C2 instructions directing compromised sites to retrieve payloads.T1090.002 · External ProxyResidential proxy services route malicious traffic through everyday devices to hide attacker origins and complicate attribution.T1189 · Drive-by CompromiseDetour Dog selectively redirects visitors from compromised websites to malware; SocGholish presents fake browser-update prompts on legitimate websites.T1195.002 · Compromise Software Supply ChainFunNull compromised Polyfill.io, while TeamPCP compromised software trusted by developers and security teams to reach downstream environments.T1557 · Adversary-in-the-MiddleAttackers used Evilginx adversary-in-the-middle phishing against university SSO portals to steal credentials and bypass multi-factor authentication.T1566.002 · Spearphishing LinkThe university phishing operation used email links leading through redirects to Evilginx phishing infrastructure.T1608.002 · Upload ToolDomain shadowing involves compromising legitimate domain DNS or registrar accounts and creating malicious subdomains.
People
Threat Actors
Detour DogSelectively redirects visitors to compromised websites into malware delivery chains and uses DNS-based C2.FaiKastThreat actor cluster using AI-generated news broadcasts and deepfake videos to lure victims into fraudulent investment platforms.FUNNULLChina-linked criminal group reported to have compromised Polyfill.io in a supply chain attack affecting more than 110,000 websites.SocGholishNamed alongside TA569 as the group targeted in a June 2026 international takedown; uses fake browser updates, device fingerprinting, and domain shadowing.TA569Presented as the tracking name associated with SocGholish in the report's discussion of a June 2026 takedown.TeamPCPCompromised Trivy, KICS, LiteLLM, and the Telnyx Python SDK in 2026, creating opportunities for credential theft and downstream malicious code distribution.Vault ViperOperates a white-label gambling platform used to launder money and move illicit funds across borders.
Malware
Vendors
Domain International Servicesdomains are consistently registered through Domain International ServicesDomainNameDNSand Namemart, and use DomainNameDNS name servers.Infobloxit is becoming more efficient, automated, conducted by Infoblox Threat IntelNamemartand Namemart, and use DomainNameDNS name servers.
Products
BCD Payinfrastructure and services needed interactions, and BCD Pay, a paymentChatGPTCursor · ChatGPT (OpenAI) · Microsoft CopilotKeitaro Trackerabuse Keitaro Tracker, a legitimate advertising platform, to scale scam andLiteLLMKICS, LiteLLM, and the Telnyx PythonPolyfill.iocompromised the widely used Polyfill.ioSCRM AIPenguin is a crime-as-a-service SCRM AI, a platform for managing