Hiding in Plain Sight: Abusing Composite Domain Names

This report analyzes DNS domain-embedding (composite query) services that encode target domains within trusted service domains (e.g., example-com.translate.goog), demonstrates how attackers exploit these services to bypass DNS/IP/SSL-based security controls, describes a multi-stage detection pipeline to extract and validate embedded domains, and presents telemetry showing significant blind spots—about 7% of distinct domains and thousands of embedded domains daily, including dozens to hundreds matching threat intelligence feeds.