Industry

Illuminating Lumma Stealer DNS Facts and Findings

The Lumma Stealer, known for using the malware-as-a-service (MaaS) model, has figured in various campaigns targeting victims in countries like Argentina, Colombia, the U.S., the Philippines, and others since 2022. more

Domain Name Industry Brief Reports 364.3 Million Domain Name Registrations in Q4 2024

The fourth quarter of 2024 closed with 364.3 million domain name registrations across all top-level domains (TLDs), an increase of 2.0 million domain name registrations compared to the previous quarter, according to the latest issue of the Domain Name Industry Brief Quarterly Report, released Thursday at DNIB.com. more

The MOONSHINE Exploit Kit and the DarkNimbus Backdoor in the DNS Spotlight

The Earth Minotaur threat group recently revived the MOONSHINE exploit kit, first discovered in 2019. According to Trend Micro's in-depth analysis, MOONSHINE had more than 55 servers in 2024 and has been updated with more exploits and functions compared with its 2019 version. more

Peering Into Midnight Blizzard’s DNS Footprint

Thousands of people working for organizations in the public, academia, and defense sectors are being targeted by spear-phishing attacks operated by a threat group called "Midnight Blizzard." The messages contained a Remote Desktop Protocol (RDP) configuration file connected to the malicious actor's server. more

Global Domain Activity Trends Seen in Q4 2024

Our research team analyzed 24.4+ million domains registered between 1 October and 31 December 2024 from the Newly Registered Domains (NRD) Data Feed. more

US Government Orders RPKI Deployment

The internet has grown organically from a cooperative lab experiment into an economic infrastructure. In the early days, configuration mistakes were an annoyance, but not much more. Today, a mistake can cost organizations money, enable security threats, and degrade reputations. more

Tracking Down APT Group WIRTE’s DNS Movements

The WIRTE advanced persistent threat (APT) group has been active since at least August 2018. It has targeted government, diplomatic, financial, military, legal, and technology organizations in the Middle East and Europe. more

WhoisXML API Launches First Watch Malicious Domains Data Feed with 97% Predictive Precision

Los Angeles, California, U.S., Jan 16, 2025 -- WhoisXML API is thrilled to announce the launch of First Watch Malicious Domains Data Feed. This innovative release delivers daily predictive threat intelligence, detecting malicious intent in domain registrations ahead of weaponization. more

New Year, Old Threats: What Does the DNS Reveal About 2025?

2025 is barely a few weeks old, but we've already heard reports of advanced phishing attacks leveraging generative artificial intelligence (AI). It's scary but not exactly surprising. Threat actors are expectedly using more sophisticated and modern attack techniques and will likely continue to rely on domain names as phishing vehicles. more

IPv4 Address Market Stabilizes: Insights and Trends for 2024

In December 2024, IPv4.Global reported a continued stabilization of IPv4 prices after a year of significant change. The monthly averages per IP address among blocks identified by CIDR notations /17-/24 remained fairly stable, fluctuating between $32 and $36 per address. more

Unraveling the DNS Connections of ToxicPanda

Banking Trojans have been around for decades and still persist to this day because they effectively siphon off victims' financial data and savings. And one of the latest additions to the ever-growing malware type - ToxicPanda - has been plaguing bank customers throughout Asia and Latin America since October 2024. more

A DNS Deep Dive into New Crypto Threat “Hidden Risk”

As of 2024, more than 560 million people own cryptocurrencies worldwide, which could translate to more than half a million potential cyber attack victims. This widespread adoption may explain the emergence of threats like Hidden Risk, a malicious campaign that uses fake crypto news to distribute the RustBucket malware. more