Industrialized cybercrime and DNS abuse: what should defenders change?

TL;DR: The 2026 threat landscape is being reshaped by industrialized cybercrime, frontier AI and DNS abuse, with 120 million newly observed domains, 27 million classified as malicious or suspicious, and 88% of threat-related domains seen in a single-customer environment, according to Infoblox. Reactive perimeter defence is losing value when attack infrastructure is automated, evasive and often invisible to conventional detection.

Editorial analysis by NHI Mgmt Group, based on content published by Infoblox: “Infoblox 2026 Threat Landscape Report”.

By the numbers:

• Infoblox identified 120 million newly observed domains over the past year.
• Infoblox classified 27 million newly observed domains as malicious or suspicious.
• 88% of threat-related domains were seen in a single-customer environment, reducing the reach of traditional detect-and-respond tools.

Key questions

Q: What breaks when adversaries can rebuild malicious infrastructure faster than defenders can block it?

A: Static blocklists, reputation checks and manual takedown workflows lose effectiveness when the attacker can rotate domains, hosts and lure content faster than the control plane updates.

Q: Why does DNS abuse make industrialized cybercrime harder to stop?

A: DNS abuse gives attackers a low-cost way to route victims, hide infrastructure and shift campaigns without changing the underlying phishing or malware logic.

Q: What signs indicate that an organisation is missing hidden attacker infrastructure?

A: Repeated lookalike domains, short-lived hostnames, single-customer sightings and lure traffic that does not match normal business patterns all suggest hidden infrastructure is slipping past controls.

Practitioner guidance

• Prioritise DNS telemetry in detection engineering Feed DNS query, resolution and domain-age data into SIEM and threat hunting workflows so short-lived attacker infrastructure is visible before it becomes a live campaign.
• Correlate identity events with infrastructure signals Join authentication logs, token use and privileged session activity with domain reputation and hosting patterns to catch account abuse tied to malicious destinations.
• Hunt for single-customer threat infrastructure Flag domains and services that appear isolated to one environment, because the report says 88% of threat-related domains were seen in a single-customer environment.

Bottom line: Industrialized cybercrime is shifting the defender problem from isolated incidents to repeatable attacker ecosystems that can regenerate infrastructure quickly.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →