Adversarial DNS techniques on the rise
The need for secure DNS transactions is highlighted in Infoblox’s 2025 DNS Threat Landscape Report, released this week, which identified 100.8 million newly observed domains, with over 25% classified as malicious or suspicious.
Over the past year, threat actors continuously registered, activated and deployed new domains, often in very large sets through automated registration processes. By increasing their number of domains, threat actors can bypass traditional forensic-based defenses, which are built on a “patient zero” approach to security, wrote Dr. Renée Burton, head of Infoblox Threat Intel, in the report.
“This reactive approach relies on detecting and analyzing threats after they have already been used somewhere else in the world. As attackers leverage increasing levels of new infrastructure, this approach becomes ineffective––leaving organizations vulnerable. Every digital interaction begins with a DNS request, making it a high-fidelity source of telemetry for network operations by providing in-depth visibility into which digital assets are initiating connections over the internet,” Burton wrote.
Consequently, analyzing DNS traffic and domain usage is foundational for security analysts. “DNS data can be reshaped into predictive threat intelligence by holistically collecting pre-attack telemetry, enriching the data, analyzing it against baselines, and executing deep threat hunts. These insights offer defenders a comprehensive view of adversarial infrastructures, targeted victims, and tactics—before the attacker strikes,” Burton wrote.
