Infoblox 2025 DNS Threat Landscape Report
Frontier AI models are accelerating vulnerability discovery, exploitation, and the mass production of single use malware infrastructure for threat actors. “Detect and respond” patient zero approaches cannot keep pace making preemptive controls increasingly critical. Read our report to learn why predictive DNS-based threat intelligence gives you a leg up in the fight against frontier AI threats.
Combating frontier AI driven attacks with DNS intelligence
The 2025 DNS Threat Landscape Report reveals how threat actors weaponize one-time-use domains, hijack trust and cloak payloads behind redirection schemes. These evolving tactics expose a critical gap in traditional malware-centric detection and response strategies, leaving organizations vulnerable to threats that evade conventional security controls. Download the report to gain insight into adversarial DNS techniques, the actors behind them and the risks they pose.
Insights from over 70 billion DNS queries analyzed daily
100.8 million
Over the past year, Infoblox identified 100.8 million newly observed domains.
25.1%
Over a quarter of newly observed domains were classified as malicious or suspicious, showing how many threats hide in plain sight.
95%
Most of the threat related domains were observed in only one customer environment, making traditional detect and respond tools far less effective.
AI-driven threats exploit trust and evade detection
This report provides a unique perspective on how attackers exploit DNS and the common tactics they use.
Hijacked trust
Threat actors exploited DNS aliases left active when organizations failed to remove them after decommissioning cloud services.
Lookalike domains
Threat actors use homoglyphs, combosquats and soundsquats to mimic trusted brands and steal credentials.
Cloaking payloads
Traffic distribution systems deliver malicious content while cloaking it from researchers and detection tools.
DNS tunneling
DNS tunneling enables covert communication and supports command-and-control and data exfiltration.
To me, no other solution vendor is providing the DNS security that Infoblox is with Threat Defense.
Jawed Khalid Mirza
CISO, Askari Bank
Ready to put preemptive security to work?
DNS is the only protocol that touches every device when it connects to the internet. It offers unmatched visibility into adversarial infrastructure and enables preemptive blocking before threats take hold.
Because if attackers hide in DNS, that’s where defense must begin.
Please send me the
DNS Threat Landscape Report
Thank you for downloading our report
Gain insight into adversarial DNS techniques, the actors behind them and the risks they pose to strengthen enterprise defense strategies.
Thanks for downloading the Infoblox 2025 DNS Threat Landscape Report. You’ve taken a critical step toward understanding how DNS visibility enables earlier detection and control over evolving threats.
Suggested Reading
