Security Articles

A historical pipeline flagged 145,061 delegations to a typo-like nameserver domain. Similar spelling alone does not establish malicious control or takeover.

Historical DNS provider concentration figures illustrate shared failure risk. Read the reported counts alongside unresolved denominator and corpus limits before using them as current market shares.

Historical nameserver-delegation candidates illustrate why owners should verify authority, provider status and domain control. An expiry-looking hostname does not prove takeover risk.

Historical zone snapshots reported low parent-DS presence. Examine the measurement limits, provider incentives, and operational reasons DNSSEC deployment can remain incomplete.

A comprehensive guide to DNS attack types including cache poisoning, amplification, tunneling, zone walking, and hijacking. Learn how attackers exploit DNS, how to test your own domains, and how to harden your infrastructure.

Phantom domain attacks overwhelm DNS resolvers by forcing them to wait for responses from domains that never answer. Learn how this resource exhaustion attack works and how to defend your resolver infrastructure.

DNSSEC downgrade attempts exploit validation gaps or permissive policies. Learn why a valid signed chain should reject stripped signatures, and how to test secure, insecure, and bogus results.

Fast flux DNS rapidly rotates the IP addresses behind a domain to hide malicious infrastructure from takedowns. Learn how single and double flux networks work, how to detect them, and how threat intelligence teams track them.

DNS rebinding manipulates DNS responses to trick a browser into treating an attacker's server and an internal network resource as the same origin. Learn how the attack works, why it bypasses firewalls, and how to defend against it.

DNS over HTTPS encrypts DNS queries inside HTTPS traffic, providing privacy but also enabling attackers to bypass DNS monitoring, content filters, and security controls. Learn how DoH is abused and how to maintain visibility.

DNS tunneling hides data inside DNS queries to bypass firewalls and exfiltrate information through port 53. Learn how encoded subdomain queries work, how to detect tunneling, and how to lock down your DNS infrastructure.

NXDOMAIN attacks flood DNS resolvers with queries for domains that do not exist, exhausting resolver resources and degrading performance for legitimate users. Learn how the attack differs from water torture and how to defend your resolvers.

Random subdomain floods can defeat ordinary per-name caching and overload authoritative DNS. Learn where NXDOMAIN cuts and validated denial caching help, and how to plan mitigation.

DNS amplification attacks exploit open resolvers to generate massive DDoS floods with up to 70x traffic amplification. Learn how reflection works, the Spamhaus case study, and how to prevent your servers from being weaponized.

A subdomain takeover happens when a CNAME points to a decommissioned cloud service that an attacker can reclaim. Learn how to find dangling DNS records, which providers are vulnerable, and how to prevent takeovers.

DNS hijacking redirects your domain's traffic by compromising registrar accounts, nameservers, or network infrastructure. Learn the four types of hijacking, real-world incidents like the Sea Turtle campaign, and how to protect your domains.

DNS cache poisoning injects forged records into a resolver's cache, silently redirecting users to malicious servers. Learn how the Kaminsky attack works, how to test your resolver, and how DNSSEC prevents it.

Ordinary NSEC chains can expose names within a DNS zone. Learn how subdomain walking differs from NSEC3 dictionary recovery and minimally covering denial responses.

Compare cleartext NSEC chains, NSEC3 hash recovery, and opt-out at the TLD level. Learn why represented delegations, registered domains, and parent-DS counts are different measures.

An unrestricted DNS zone transfer hands an attacker your complete zone file, every subdomain, IP address, and service record. Learn how AXFR works, how to test your own nameservers, and how to lock down zone transfers.

An open DNS resolver accepts recursive queries from anyone on the internet, making it a weapon for DDoS amplification attacks. Learn how to check if your server is an open resolver and how to lock it down.

Before you file an abuse report against that IP hammering your server, check the User-Agent. This guide covers how to identify web crawlers, manage them with robots.txt and server-level controls, and decide when to block, allow, or report.

Usenet remains active and so does its abuse. This guide covers how to report spam, copyright infringement, and illegal content on newsgroup servers, including how to trace posts to source IPs and file complaints with Usenet providers.

CERT teams coordinate responses to security incidents across organizations and borders. This guide explains when to contact a CERT, how to write incident reports they can act on, and provides templates for common scenarios like vulnerability exploitation and network intrusions.

Sometimes ISP abuse reports aren't enough. You need law enforcement involved. This guide covers when to escalate to authorities, how to file reports with FBI IC3, Europol, and national CERTs, and what evidence to prepare for a criminal investigation.

Report suspected online child sexual exploitation through official channels. Do not download, screenshot or investigate the material. Provider duties are a separate workflow.

When someone hosts your copyrighted content on their server, a properly formatted DMCA takedown notice is the fastest legal tool to get it removed. This guide includes a ready-to-use template, explains the legal requirements, and walks through finding the right abuse contact.

Phishing sites can steal credentials in minutes, so speed matters when reporting them. This guide covers how to trace phishing emails and websites to their hosting IP, file takedown requests with hosting providers, and report to anti-phishing organizations.

Spam wastes bandwidth, clogs inboxes, and often carries malware. This guide shows you how to trace spam back to its source IP, extract the evidence from email headers, and file abuse reports that get spammers shut down.

A compromised server is often used to launch attacks on others. After containing the breach, reporting the compromise to your hosting provider and the attacker's ISP helps shut down the attack chain and protects other potential victims.

When you detect command-and-control traffic reaching out to a malicious IP, reporting that C2 server can disrupt the entire botnet. This guide covers how to identify C2 indicators, collect network evidence, and file reports that get C2 infrastructure taken down.

Port scanning is often the first step in a targeted attack. This guide explains how to detect network reconnaissance in your firewall logs, gather evidence, and report the scanning IP to its ISP before an actual attack follows.

Brute force attacks against SSH and RDP are relentless and automated. This guide shows you how to extract the evidence from your auth logs, identify the attacking IP's abuse contact, and file reports that get malicious hosts shut down.

When a DDoS attack hits your infrastructure, the clock is ticking. This guide walks you through collecting the right evidence, finding your attacker's ISP abuse contact, and filing a report that actually gets the attack stopped.

Most abuse reports get ignored because they lack evidence or go to the wrong contact. This complete guide covers how to identify the right abuse contact, write reports that ISPs actually act on, and escalate when they don't respond.

DNSSEC protects your domain from cache poisoning and DNS spoofing by adding cryptographic verification to DNS responses. Learn how it works, why it matters, and how to enable it.

Learn how SPF, DKIM, and DMARC DNS records work together to authenticate your email, prevent spoofing, and protect your domain reputation. Includes example records and setup guidance.

A historical analysis of 201 million CNAME records found 3.27 million matches to selected cloud-provider patterns. What those matches show, and why they do not establish takeover vulnerability.

Seven historical FDNS snapshots reported growth from 23.5 million to 219.7 million AAAA records. Changing coverage prevents treating that 9.35x corpus growth as an Internet adoption rate.

Historical SPF observations and practical checks for permissive policies, lookup limits, redirect behavior and TXT formatting, with unresolved dataset limits stated explicitly.

Two historical TXT snapshots reported different SPF and DMARC record populations. Read the observed policy shares with scan-coverage, cohort, and provenance limits.

Reported 2019 TCP responses on MQTT- and Telnet-associated ports, with limits on device counts, protocol identity and authentication claims.

Historical 2019 TCP SYN observations across 16 conventional service ports, including 24.3 million port-22 responses. Open ports do not establish application identity or vulnerability.