TLD Tracker: Exploring Newly Released Top-Level Domains
ID: 67828b37-a121-5b7a-b279-7c1338261655
STIX ID: report--67828b37-a121-5b7a-b279-7c1338261655
Feed Name: Palo Alto Networks Unit 42
Date Published: 2024-08-30
Date Updated: 2026-04-28
Author: Reethika Ramesh, Zhanhao Chen, Wanjin Li and Daiping Liu
This Unit 42 investigation analyzes abuse of 19 newly released top-level domains, showing that attackers rapidly register and weaponize these TLDs for phishing/redirection campaigns, chat-bot/SMS scams, torrent/piracy distribution, and distribution of potentially unwanted or malicious files; the report describes graph-based detection of coordinated clusters (including 112-domain and 92-domain clusters), provides IoCs, and emphasizes the need to monitor new gTLDs to mitigate domain squatting and phishing risks.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.