Chinese Malware Delivery Domains Part IV

According to DomainTools Investigations, a large cluster of malware delivery domains has been active since June 2023, with more than 2,800 domains reported in Part III (July 2025) and a further 1,900 additional domains observed from May to November 2025, bringing the cluster to around 5,000 domains overall.

The report highlights an experimental AI-driven analysis workflow where agentic AI enabled analysts to process thousands of domains rapidly, achieving 2,000 malware delivery domains in roughly 10 hours in a three-worker run. Operational data show a peak activity period around UTC 22:00 (276 domains, 13.9%), with 191 of those from a single Oct 16 bulk registration event, and a weekend activity ratio of 3.26:1, higher than the expected 2.5:1.

Infrastructure evolution moved from a Consolidated phase (May–July 2025) featuring Alibaba Cloud Hong Kong and WebNIC at 98% concentration to a Diversified phase (August–September 2025) and a Localization phase (October–November 2025) emphasising Chinese domestic registrars, notably 四川域趣网络科技有限公司 as the primary registrar. The analysis repeatedly notes targeting of Chinese-speaking users and ongoing spoofing of legitimate software download sites, with clusters of 1,900 domains examined from May to November 2025.