Iran unrest domain clusters: what security teams should watch

TL;DR: Bfore's PreCrime Labs found 580 Iran-themed domain registrations between 1 December 2025 and 15 January 2026, with concentrated use of privacy services, a small registrar set, and cheap TLDs that point to prepositioned abuse infrastructure. The pattern shows how geopolitical unrest can be operationalised through domains before campaigns fully activate, so brand, fraud, and policy controls need to move earlier.

Editorial analysis by NHI Mgmt Group, based on content published by Bfore: “Malicious Infrastructure Campaigns: How Unrest in Iran is Being Weaponized Online”.

Key questions

Q: What should teams do first when conflict-themed domains start appearing in volume?

A: Start by clustering the registrations, not by reviewing them one by one.

Q: Why do cheap TLDs and privacy services increase abuse risk?

A: Cheap TLDs lower the cost of scale, while privacy services reduce attribution and slow down takedown coordination.

Q: What are the signs that domain registrations are part of a coordinated campaign?

A: Look for repeated labels across many TLDs, clustered registration dates, common nameserver sets, shared registrar patterns, and themes that align with an external event or controversy.

Practitioner guidance

• Build domain-age and theme-based scoring Weight newly registered domains by age, theme family, registrar concentration, privacy protection, and proximity to real-world events so high-risk names surface first.
• Cluster near-duplicate domains across TLDs Group repeated labels such as one name across many extensions so one operator's campaign is visible as a family instead of many isolated records.
• Escalate registrar and DNS outliers Flag unusual combinations of registrar, nameserver, and registrant geography for joint review by security, abuse, legal, and compliance teams.

Bottom line: Conflict-linked domain registrations can be used as an early warning layer for fraud, propaganda, and sanctions-related abuse.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →