From dangling DNS records to reverse DNS gaps, attackers find new blind spots

DNS underlies nearly every action taken on a network. A website visit, an email, a call to an AI application—all of it starts with a , attackers are abusing DNS in novel and unique ways to exploit users. The report frames cybercrime as an increasingly industrialized business, with commodity services lowering the barrier to entry for attackers who no longer need deep technical skill to operate at scale. Several of the report’s DNS-specific findings illustrate how that industrialization plays out at the protocol level.

Top DNS findings from the report include the following:

• More than 120 million newly registered domains were observed from June 2025 to June 2026, and more than 22% were weaponized or showed threat characteristics.





• 44% of threat related domains were active for just one day.





• 96% of customers encountered traffic distribution system domains, the DNS linked routing and cloaking infrastructure attackers use to steer selected victims to scams or malware.





• 65% of customers queried domains associated with residential proxy services, which can conceal malicious traffic behind seemingly legitimate residential IP addresses.





• One-third of identified dangling CNAME records were reportedly easy or trivial to take over, creating a path to trusted subdomain hijacking.

“It’s kind of crazy stuff,” , told Network World. “It continues to amaze me.”

Dangling DNS records give attackers an easy way in

One of the report’s more counterintuitive findings involves dangling CNAME records, a class of )

Infoblox does not sell this as a problem its products alone solve. Burton described it as a lifecycle management issue rather than a product gap. Her recommendation centers on process. Organizations need policies that require decommissioned cloud services to be reported and their DNS records removed, along with regular audits of DNS zones to catch orphaned records before an attacker finds them.

Traffic distribution systems remain the dominant threat vector

Traffic distribution systems, or TDS, affected 96% of Infoblox customers at peak reach in the report, the highest of any threat category measured. A TDS profiles a visitor by device type, location, browser and behavior, then decides in real time whether to deliver a scam, malware or a benign page.

A researcher or automated scanner visiting the same link as a targeted victim may see a harmless decoy, while the intended target is routed to the actual payload. “The way I think about them is that they’re really bulletproof routing systems,” Burton said.

The report documents selective routing in its research on Detour Dog, a threat actor cluster that used DNS TXT record queries to deliver the Strela Stealer malware. According to the report, 95% of visits to a compromised site linked to the campaign served benign content, with only visitors matching a specific target profile routed into the infection chain.

Reverse DNS infrastructure exploited through .arpa abuse

Another unexpected threat vector that the report exposed is a novel reverse DNS attack.

The report’s research into abuse of the .arpa top level domain describes a threat vector built on infrastructure most network teams do not think about as an attack surface at all. The .arpa domain exists for a narrow technical purpose, primarily reverse DNS lookups that map IP addresses back to domain names. It is not meant to host arbitrary DNS records.

According to the report, attackers obtained IPv6 address space and gained control of the associated reverse DNS zones, then created DNS records under .arpa designed to make spam email links appear more legitimate. Victims who clicked those links were routed through traffic distribution systems to phishing pages and other malicious content, with the .arpa infrastructure providing a layer of apparent legitimacy that helped the links evade scrutiny.

Burton attributed the root cause to inconsistent enforcement of existing technical rules governing .arpa use. Infoblox identified the issue on Cloudflare’s infrastructure specifically and reported it. Cloudflare fixed the problem following that disclosure, according to Burton, though she said the technique is still being observed at smaller organizations that have not implemented the same controls.

Asked what stood out most about the .arpa research, Burton pointed to how unlikely the abuse should have been in the first place. “You would never think about it, because it’s not supposed to happen, right?” Burton said.