Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This longitudinal study analyzes 1.52 million malicious domains identified on VirusTotal between January and May 2026, focusing on their characteristics and abuse patterns. By categorizing domains into compromised and attacker-created, the research reveals that most attacker-created domains are short-lived and highlights the concentration of abuse among a few registrars and TLDs. Key findings indicate significant exploitation of Cloudflare for domain fronting and widespread bulk registration practices, with notable impersonation of major global brands like WhatsApp and Google.
A staggering 89.3% of malicious domains are either compromised or created by attackers, with a shocking reliance on just a few registrars for most abuse.
We present a longitudinal study of approximately 1.52 million malicious domains observed on VirusTotal (VT) between January and May 2026. Domains were selected on the basis of detection by at least five independent VT scanning engines and a first-seen date within the study window. We group the dataset into compromised domains and attacker created domains, which account for approximately 89.3% of the dataset. Combining WHOIS registration records and passive DNS (PDNS) data with the VT dataset, we characterise attacker behaviour across eight dimensions: temporal distribution, compromisedvs.attack classification, domain age at first detection, registrar and TLD preferences, DNS query volume as a damage proxy, hosting infrastructure concentration (IP and ASN level), bulk registration patterns, and brand impersonation. Key findings include: the majority of attacker created domains are short lived registrations used within weeks of creation; a small number of registrars and TLDs account for most abuse; Cloudflare infrastructure is heavily exploited for domain fronting; bulk registration events involving thousands of domains from a single registrar on a single day are widespread; and several global brands, particularly WhatsApp and Google, are heavily impersonated. We share the annotated dataset in the GitHub repo https://github.com/mufimash/malicious_domains for further research.