Exploit Kits Power a Rise in Creation of Malicious Domains

The 4Q15 Infoblox DNS Threat Index shows a dramatic increase in malicious domains, powered in part by exploit kits.

While the DNS Threat Index was first released in July 2015, in the past it was a joint effort of Infoblox with threat intelligence vendor IID. In February of this year, Infoblox acquired IID for $45 million in cash.

It’s important to note that Infoblox’s methodology is not a comprehensive list of all domains on the Internet, but rather is based on a representative sampling.

The key trend identified by the report is that malicious domain creation grew in 2015 at a somewhat uneven rate. The fourth quarter saw a 5 percent gain over the third quarter but a 49 percent gain over the fourth quarter of 2014.

While anyone anywhere in the world can potentially create and host a malicious domain, Infoblox found that 72 percent of malicious domains with a knowable country of origin were hosted in the U.S.

The Q4 DNS Threat Index reported that Germany came in second in terms of malicious domain geography, at 19.7 percent. Other countries had small representation, with Turkey at 1.8 percent, Ireland at 1.79 percent, Switzerland at 1.27 percent and the United Kingdom at 1.14 percent.

A key consumer of malicious domains are exploit kits, which provide easy-to-use toolkits that enable attacks to exploit users. In the fourth quarter of 2015, Infoblox reported that the Angler exploit kit represented 56 percent of observed exploit kit activity.

During the fourth quarter, Infoblox found a surge in the use of the RIG exploit kit, pushing it into second place ahead of Magnitude. RIG’s surge is likely short-lived, though, thanks to actions taken in early 2016 by Cisco to disrupt the exploit kit’s operations.