Among 120 million newly registered domains, more than 22% were weaponized or showed threat characteristics, according to Infoblox's 2026 Threat Landscape Report.
DNS underlies nearly every action taken on a network. A website visit, an email, a call to an AI application—all of it starts with a DNS lookup. That dependency cuts both ways. Attackers rely on the same lookups to route victims through malicious infrastructure, and increasingly they do it using techniques that were never supposed to work on the DNS system in the first place.
According to Infoblox’s 2026 Threat Landscape Report, attackers are abusing DNS in novel and unique ways to exploit users. The report frames cybercrime as an increasingly industrialized business, with commodity services lowering the barrier to entry for attackers who no longer need deep technical skill to operate at scale. Several of the report’s DNS-specific findings illustrate how that industrialization plays out at the protocol level.
Top DNS findings from the report include the following:
- More than 120 million newly registered domains were observed from June 2025 to June 2026, and more than 22% were weaponized or showed threat characteristics.
- 44% of threat related domains were active for just one day.
- 96% of customers encountered traffic distribution system domains, the DNS linked routing and cloaking infrastructure attackers use to steer selected victims to scams or malware.
- 65% of customers queried domains associated with residential proxy services, which can conceal malicious traffic behind seemingly legitimate residential IP addresses.
- One-third of identified dangling CNAME records were reportedly easy or trivial to take over, creating a path to trusted subdomain hijacking.
“It’s kind of crazy stuff,” Renée Burton, vice president of threat intelligence at Infoblox, told Network World. “It continues to amaze me.”
Dangling DNS records give attackers an easy way in
One of the report’s more counterintuitive findings involves dangling CNAME records, a class of DNS misconfiguration that looks harmless on the surface.
A CNAME record points one domain name to another. When the destination expires or the resource behind it is shut down, the record itself often gets left behind, still resolving to nothing until an attacker claims it.
Burton said Infoblox has tracked the problem across multiple published papers, and that it extends beyond CNAMEs to dangling MX and A records as well. She described two patterns. The older one involves a time limited promotional campaign that points a CNAME at an external domain, which later expires and gets registered by someone else once the campaign ends and the record is forgotten. The larger and more common pattern now involves cloud infrastructure. An organization spins up a resource such as an Azure Web App or an AWS S3 bucket, decommissions it, and leaves the DNS record behind. An attacker who finds the orphaned record can register a new resource under the same hostname and inherit its traffic.
The root cause is organizational rather than technical. “The reason that happens is because you have global enterprises where lots of people are asking for DNS records to be set up, and oftentimes that might be centralized,” Burton said.
Management of those records afterward is where the process typically breaks down. The employees who requested a given record in the first place rarely think to ask for it to be removed once the underlying campaign or cloud resource is retired, and without a formal process to catch that gap, orphaned records simply persist. (Read more: DNS security is often inadequate, and network engineers should get more involved)
Infoblox does not sell this as a problem its products alone solve. Burton described it as a lifecycle management issue rather than a product gap. Her recommendation centers on process. Organizations need policies that require decommissioned cloud services to be reported and their DNS records removed, along with regular audits of DNS zones to catch orphaned records before an attacker finds them.
Traffic distribution systems remain the dominant threat vector
Traffic distribution systems, or TDS, affected 96% of Infoblox customers at peak reach in the report, the highest of any threat category measured. A TDS profiles a visitor by device type, location, browser and behavior, then decides in real time whether to deliver a scam, malware or a benign page.
A researcher or automated scanner visiting the same link as a targeted victim may see a harmless decoy, while the intended target is routed to the actual payload. “The way I think about them is that they’re really bulletproof routing systems,” Burton said.
The report documents selective routing in its research on Detour Dog, a threat actor cluster that used DNS TXT record queries to deliver the Strela Stealer malware. According to the report, 95% of visits to a compromised site linked to the campaign served benign content, with only visitors matching a specific target profile routed into the infection chain.
Reverse DNS infrastructure exploited through .arpa abuse
Another unexpected threat vector that the report exposed is a novel reverse DNS attack.
The report’s research into abuse of the .arpa top level domain describes a threat vector built on infrastructure most network teams do not think about as an attack surface at all. The .arpa domain exists for a narrow technical purpose, primarily reverse DNS lookups that map IP addresses back to domain names. It is not meant to host arbitrary DNS records.
According to the report, attackers obtained IPv6 address space and gained control of the associated reverse DNS zones, then created DNS records under .arpa designed to make spam email links appear more legitimate. Victims who clicked those links were routed through traffic distribution systems to phishing pages and other malicious content, with the .arpa infrastructure providing a layer of apparent legitimacy that helped the links evade scrutiny.
Burton attributed the root cause to inconsistent enforcement of existing technical rules governing .arpa use. Infoblox identified the issue on Cloudflare’s infrastructure specifically and reported it. Cloudflare fixed the problem following that disclosure, according to Burton, though she said the technique is still being observed at smaller organizations that have not implemented the same controls.
Asked what stood out most about the .arpa research, Burton pointed to how unlikely the abuse should have been in the first place. “You would never think about it, because it’s not supposed to happen, right?” Burton said.
