Infoblox says 22% of new domains are hostile — and the best tricks are DNS tricks

Published August 3, 2026 · DNS Benchmark Pro Editorial · Reading time: 4 minutes

In short — Infoblox's 2026 Threat Landscape Report counts 120 million newly registered domains in a year, of which more than 22% show threat characteristics. The techniques it documents — dangling CNAMEs, .arpa abuse, traffic distribution systems — are all designed specifically to beat the reputation systems your filtering resolver runs on.

On 31 July 2026, Infoblox published its 2026 Threat Landscape Report. The headline number is the one that will get quoted: more than 120 million newly registered domains observed between June 2025 and June 2026, of which more than 22% were weaponized or showed threat characteristics. That is roughly 26 million hostile domains in twelve months.

The number worth paying attention to is a different one. 44% of threat-related domains were active for just one day. That single figure explains most of what follows, and it is bad news for anyone who assumed a filtering resolver was doing more work than it actually is.

Three techniques, one target

The report documents several DNS-specific tactics. What unites them is that none of them attack the DNS protocol. They attack reputation — the layer that every blocklist-driven resolver depends on.

Dangling CNAME hijacking. A CNAME points one name at another. When the destination expires or the cloud resource behind it is torn down, the record is routinely left in place, resolving to nothing. An attacker who finds it registers a resource at the same hostname and inherits the subdomain — along with the parent brand's clean reputation. Infoblox found that one third of the dangling CNAME records it identified were easy or trivial to take over. Renée Burton, the company's VP of threat intelligence, put the root cause in organizational rather than technical terms: records get requested centrally, and nobody ever thinks to request their removal.

.arpa abuse. This is the genuinely novel one, first written up by Infoblox in February 2026. The .arpa TLD exists for reverse DNS — mapping addresses back to names via PTR records. It is not supposed to host anything. An actor acquires an IPv6 /64, which delegates them control of the corresponding ip6.arpa subtree, and then publishes A records where PTR records belong, prepending a random label so every FQDN is unique:

d.d.e.0.6.3.0.0.0.7.4.0.1.0.0.2.ip6.arpa

The resulting name resolves, serves phishing content, and carries the implicit clean reputation of core internet infrastructure. Blocklists keyed on URL structure and registration data have nothing to match — reverse DNS names have no registration data. Infoblox observed the technique working through both Hurricane Electric and Cloudflare; Cloudflare fixed it after disclosure, but Burton says smaller providers still allow the configuration.

Traffic distribution systems. TDS infrastructure reached 96% of Infoblox customers, the highest of any category measured. A TDS fingerprints the visitor and decides in real time whether to serve the payload or a decoy. In the Detour Dog cluster — which used DNS TXT queries to deliver Strela Stealer — 95% of visits to a compromised site were served benign content. Your scanner sees nothing. The target sees the malware.

What this means if you are picking a resolver

Filtering resolvers — Quad9, DNS4EU, Cloudflare's 1.1.1.2, and the rest — are worth having. They are cheap, they are one configuration change, and they stop a meaningful volume of commodity attacks. We are not arguing against them.

But be honest about the mechanism. A filtering resolver is a reputation lookup, and every technique above is engineered to defeat a reputation lookup. A domain that lives for one day is gone before most feeds ingest it. A hijacked subdomain of a university or a telco inherits reputation you would never block. An .arpa name has no reputation to be bad. The 96% TDS reach figure is not a measure of failed blocking so much as a measure of how much of this traffic simply does not look blockable.

The practical read: treat DNS filtering as one cheap layer among several, not as the control. And when you are choosing between resolvers, evaluate the filtering and the latency separately — filtering is a policy decision, speed is a measurable one. Our benchmark measures the second, over real DoH queries from where you actually sit, because that is the part where vendor claims and reality most often diverge.

If you run domains rather than just resolve them, the actionable item is duller and more useful: audit your zones for orphaned CNAME, MX and A records, and make DNS record removal part of your cloud decommissioning process. A third of dangling records being trivially claimable is not an attacker innovation. It is a housekeeping failure.

Sources: Network World, "From dangling DNS records to reverse DNS gaps, attackers find new blind spots" (31 July 2026); Infoblox, 2026 Threat Landscape Report; Infoblox Threat Intel, "Abusing .arpa: The TLD That Isn't Supposed to Host Anything" (26 February 2026).

← All DNS news Run the free DNS benchmark

Published by Genext Information Systems · August 3, 2026. DNS Benchmark Pro is an independent tool and is not affiliated with any vendor or organisation named in this article. This report summarises publicly available disclosures and is provided for informational purposes.