Threat Actors Exploiting Dynamic DNS Providers for Malicious Activity

Cybersecurity researchers warn that threat actors are increasingly exploiting Dynamic DNS providers to host malicious infrastructure, a trend highlighted in Silent Push’s latest research. The study notes that over 70,000 domains are currently renting subdomains through these services, many with minimal oversight and lax security.

It also reveals that afraid[.]org hosts tens of thousands of domains renting subdomains, with some dating back around 25 years, and that Silent Push has identified over 591,000 results for afraid[.]org through NameServer DNS searches. Major campaigns have seen groups such as APT29, noted forQUIETEXIT in 2022, and Scattered Spider in January 2025, leveraging Dynamic DNS, while APT28 (Fancy Bear) was mentioned in a 2024 FBI report for heavy use of dynamic DNS domains.

The article traces the history back to 2014 when Microsoft led takedown efforts of No-IP domains, and warns that these services complicate takedowns and allow command-and-control communications via subdomains that might bypass normal abuse handling.