Rent-a-Domain: Report Details How APTs and Cybercriminals Abuse DDNS Services for Malicious Infrastructure

A new analysis from Silent Push Threat Analysts highlights the growing misuse of publicly rentable subdomain providers, also known as Dynamic DNS services, by cybercriminals and advanced persistent threat groups. These services, marketed as flexible hosting solutions, are used for command-and-control servers, phishing sites, and malware delivery infrastructure, with attackers taking advantage of low oversight and transient hosting arrangements.

According to Silent Push, publicly rentable subdomain providers can be benign but are frequently exploited by threat actors, enabling infrastructure that persists even after abuse reports. The report names campaigns and actors including Gamaredon in espionage against Ukraine, Scattered Spider in a January 2025 operation, and APT28 (Fancy Bear) and APT29 leveraging DDNS for C2, alongside historical use by APT33, Gallium and APT10, with commodity malware such as DarkComet also distributed via these infrastructures.

Silent Push has created monitoring datasets to track more than 70,000 domains renting subdomains to help enterprises monitor or block connections based on risk. The data combines sources like the Public Suffix List and providers such as afraid[.]org, DuckDNS, and NoIP, plus stealth domains detectable only via NameServer records.