Industry

Domain Blocking: The Future of Brand Protection

Since 2014, more than 800 new domain extensions have been added to the internet. In addition to the ubiquitous .com and country-code extensions such as the United Kingdom's .uk and Japan's .jp, unique spaces have been created for industry sectors, special interests, geographical regions and more. more

Unveiling Global Domain Activity Trends in Q4 2023

The new domain name registration volume rose 10.24% from the third to the fourth quarter of 2023. WhoisXML API researchers uncovered this finding, along with other DNS trends, after analyzing more than 31 million newly registered domains (NRDs) added from 1 October to 31 December 2023 as seen in the Newly Registered Domains Data Feed. more

Scouring the DNS for Traces of Bumblebee SEO Poisoning

Google ad or search engine optimization (SEO) poisoning has long been a favored threat actor tactic to spread malware. A recent Secureworks study of Bumblebee, which comes in the guise of a software installer, proved that once again. more

Radix Releases 2022 Domain Renewals Data

Radix, one of the world's largest portfolio registries, has released a report on domain renewals based on Radix's internal analysis of nTLD renewals in 2022. more

Bring Your Own IP (AWS-BYOIP) - AWS to Charge for IPv4

On Friday, July 28, 2023, AWS announced they would begin charging for every IPv4 address an account is allocated or using on the platform, starting February 1, 2024. That's a change from the current scheme, which only charges you for addresses you reserve, but aren't using, or if you reassign the same address over a hundred times a month. more

Catching Messenger Phishing Footprints Using a DNS Net

A phishing campaign is currently targeting Facebook business accounts with password-stealing malware. The attackers have been using a massive network of fake and compromised Facebook accounts to send out millions of Messenger phishing messages. more

A Log4Shell Malware Campaign in the DNS Spotlight

The Log4Shell zero-day vulnerability, also known as "CVE -- 2021 -- 44228," proved to be one of the worst bugs disclosed in December 2021. And while a patch for it has been made available via the Log4j 2.17.1 release seven days after its discovery, some affected systems could remain vulnerable to date. more

From URSNIF IoCs to Software Spoofing: Using DNS Intel to Connect the Dots

Financially motivated threat actors called "TA544" were first detected in 2017. TA544 is known for high-volume campaigns, sending hundreds of thousands of malicious messages daily. more

Examining WoofLocker Under the DNS Lens

WoofLocker tech support scams have been wreaking havoc since 2017 but the threat actors behind it don't seem to be done yet. In fact, the threat may have become even more resilient. more

IPv4.Global Hits $1 Billion Milestone for IPv4 Sales

Of the five Regional Internet Registries responsible for distributing IP addresses, most have run out of IPv4 addresses. However, there remains a healthy global demand for IPv4 addresses, especially by growing networks. These assets, which rarely appear on balance sheets or asset schedules, have become a source of liquidity for organizations in all sectors with unused blocks of addresses. more

Investigating the UNC2975 Malvertising Campaign Infrastructure

Mandiant's Managed Defense Threat Hunting Team recently published an in-depth study of the malware distributed via what they have dubbed the "UNC2975 malvertising campaign." Users who have been tricked into clicking poisoned sponsored search engine results and social media posts ended up with computers infected with either the DANABOT or DARKGATE backdoor. more

Scanning for LockBit Ransomware DNS Traces

ReliaQuest named LockBit one of the most effective and undoubtedly most prolific currently active ransomware groups today. In fact, the malware topped their latest ransomware quarterly list for the first three months of 2023, a continuation of their 2022 observation. more

Tracing Truebot’s Roots through a DNS Deep Dive

On 12 June, the DFIR Report published an in-depth analysis of a Truebot intrusion that began with several page redirects via a Traffic Distribution System (TDS) and ended with dropping a Master Boot Record (MBR) killer wiper onto a victim's computer. The result? more

IPv4 Price Trends & Expectations

Predicting rational behavior on the part of market participants invites two problems into the resulting projections. First, people almost always include some element of irrational thinking in their decisions. Second, no predictor can know every variable -- even only the rational ones -- or weigh those they know with perfect accuracy. more

A Peek Under the Hood of the Atomic Stealer Infrastructure

The Atomic Stealer, also known as "AMOS," first emerged in September this year by spreading on Macs disguised as popular applications. This time around, it has been wreaking more havoc in the guise of a fake browser update dubbed "ClearFake." more