Malicious Domains: A Cybersec Foundation

Insights

Malicious domains are a foundational layer of threat intelligence and provide critical visibility into where attackers operate online. You can integrate domain-based intelligence across your security stack to: enhance prevention with DNS filtering and firewall rules, improve detection via IDS/IPS systems, guide SOAR-driven response playbooks, and support retrospective threat hunting. Their versatility makes them valuable for organizations of any size because they serve as both a frontline defense and an investigative asset.

Why Domains (Not Just IPs) Matter

Blocking domains offers a more precise and effective way to deny access to malicious infrastructure compared to blocking at the IP-level. Unlike IP addresses, which are often shared across many services and tenants (e.g., cloud providers), domains tend to be unique to the threat actor’s campaign or infrastructure. Blocking a malicious IP risks affecting legitimate services; blocking a malicious domain is more targeted and typically less prone to false positives.

Where to Get Domain Blocklists

There are several sources for malicious domain blocklists:

  • Commercial Threat Intelligence Vendors – They offer curated, regularly updated feeds, often enriched with context like first-seen dates, associated malware families, or related indicators (IPs, hashes, etc.).
  • Open Source Intelligence (OSINT) – Communities such as Abuse.ch, PhishTank, and threat-sharing platforms publish free lists. While useful, they can vary in accuracy, timeliness, and depth of context.
  • Internal Sources – Your organization’s own detection systems (e.g., sandboxing, phishing reports) can be a powerful generator of high-confidence domains worth adding to local blocklists.

Of course, not all feeds are created equal. Freshness, coverage, and enrichment are key to determining how useful a feed is in real-world defensive operations.

The Importance of Freshness and Context

Threat actors continuously evolve their infrastructure. Domains can be registered and weaponized within minutes. That’s why static or infrequently updated lists are of limited use. A quality feed should not only be updated frequently, ideally hourly or daily, but also provide context: Why is this domain flagged? Is it linked to a specific malware family? Was it part of a known phishing kit? When was it first detected?

Rich metadata and context allow security teams to make informed decisions. For example, knowing a domain is associated with a known command-and-control server for a particular ransomware strain might justify more aggressive response actions than if it were merely flagged for spam.

How to Use Malicious Domain Feeds

You can integrate domain intelligence into your environment in several ways:

  • Network Controls – Feed domains into firewalls, DNS security tools, or secure web gateways to block access in real time.
  • IDS/IPS Systems – Tools like Suricata or Snort can inspect DNS traffic for requests to known bad domains and generate alerts or drop packets.
  • SIEMs and SOARs – Enrich alerts with domain context to improve triage speed and accuracy.
  • EDR and XDR – Use domain feeds to flag suspicious outbound connections from endpoints and correlate with other malicious activity.
  • Threat Hunting – Historical DNS logs or proxy logs can be cross-referenced against the feed to identify prior compromise.
Best Practices for Operational Use
  1. Use Multiple Feeds – Every source has limitations in coverage, geography, etc. Selecting feeds from multiple vendors and publicly available offers help to maximize coverage.
  2. Automate Ingestion and Updates – Integrate feeds into your tech stack with automation tools or platforms.
  3. Monitor for Overblocking – Even with domain-level granularity, verify false positives and build feedback loops to tune your blocklists.
  4. Use Enriched Feeds for Decision Making – Context reduces alert fatigue and helps prioritize incident response.

Final Thoughts

Malicious domain feeds are a tried and true foundational element of threat prevention, detection, and response. From stopping phishing attempts to flagging command-and-control activity, domain-level intelligence provides a tactical advantage in defending against today’s fast-moving threats.

Malware Patrol offers domain intelligence designed to meet the needs of security teams who require both breadth and depth. We cover a wide range of threats, from phishing and malware to emerging threats, cryptomining, DGAs, and C2 infrastructure. Our feeds are also enriched with the metadata that helps turn alerts into action. For ease of use, we format the feeds for compatibility with the most popular security tools and platforms.

Ready to add precision and power to your defenses? Contact us to learn more or to request a free trial.

?

How big are your threat data gaps?

See for yourself.

Free Data Evaluation
?

Why choose Malware Patrol over a free DNS protection service?

Insights

??

Customers and prospects have approached us recently with questions similar to this: why should we choose Malware Patrol instead of a free DNS protection service? The question is fair, especially in a market that counts with, at least, 93 different offers of free DNS, including big players like Cloudflare, Cisco and Quad9.

We want to provide the facts so you can decide for yourself. These services present themselves as something like a “DNS platform that provides end users robust security protections, high-performance, and privacy”. Although the idea of consolidating multiple threat data sources and providing a protection service is very appealing, there are many aspects to take into account before you change your DNS settings.

First of all, remember that nothing is really free in life. The saying ‘if you’re not paying for the product, you are the product’ is true more than ever. In this case, it means you are giving away data about everything you do online.

Every time you visit a web site, use a social media app, read emails, watch a movie or do pretty much anything online, your device makes DNS queries to determine the IP addresses of the various services it needs to access. Although some of these DNS service providers say they don’t log your IP address, they do log queries and a lot of data can be derived from that. The byproducts range from “passive DNS” collection to usage patterns and present a threat to privacy.

Everybody wants your DNS queries. The service providers created complex infrastructures that use anycast and servers hosted in multiple locations, but who pays for that all? Most likely the data you passively provide when using their services.

Second, what do they protect you from, really? Many of these services mention you are protected from malware and phishing, but there is no word on the threat data sources, amount of data, how it is validated, how it is aged, and so on. You are protected, but don’t know from what. Is this really the protection you need? Does it cover the most recent malicious campaigns, the ones that affect your country and language? There is no way to know.

Third, these service providers mention they white list legitimate domains. How does that work? Who says a domain is legitimate and assures it will never host a malware? The recent years proved that no website is totally immune to attacks and been tagged as legitimate is no guarantee it won’t be invaded and used to distribute malware. In fact, the more a website is considered benign, the bigger a price it becomes to hackers who want to distribute badness.

And finally, why do companies share their threat data for free with these service providers when they sell the same data for big bucks? Thinking about that, one can clearly see a conflict of interest there. These companies either don’t share the most up-to-date data or are monetizing from the information received from the service providers, also known as your DNS queries.

At Malware Patrol, we have a different approach. We have been monitoring malicious campaigns since 2005 and that is what we do as our core business. Apart from collecting data on malware and ransomware activities, we validate the data to make sure campaigns are active. We don’t age data, entries are only removed from our feeds once we know for a fact that the threat isn’t available anymore.

Our customers can use this threat data in most industry security software/platforms, including DNS servers. For DNS, we let them download zone files that are updated every hour, or automatically and in real time synchronize zones using the RPZ mechanism, providing a reliable DNS Firewall solution. This way, customers retain total control of their DNS infrastructure and their privacy. We don’t resolve queries, we provide the data your servers need to block them. And, on top of not leaking any data from your company, you can configure a “walled garden”, redirecting employees or customers to an informative and educative website under your control, every time they try to reach a blocked address.

DNS privacyTo further customize their security, we allow customers to control what they want to block. The threat data is divided into 4 different zones and each can be used separately:

1) domains hosting malware and ransomware

2) C2s domains

3) DGAs (domains generated via algorithms) used by malware and ransomware

4) cryptominers – domains that abuse visitor’s CPU to mine crypto currencies.

Through all these years, we have seen so many “legitimate domains” hacked to host badness and ones that simply allow users to freely upload malware to their accounts. For example, is ‘dropbox.com’ legitimate? Sure, it is. Does it host malware? Yes, and very often. Should a DNS service provider block ‘dropbox.com’? For us, it depends.

Our approach is to provide customers the complete information, informing them that ‘dropbox.com’ is hosting bad stuff. Then, they can make an informed decision about whether or not to white list it, based on their understanding of the threat as well as their internal policies. Customers can easily white list domains they don’t want blocked, even those hosting malware. We understand that sometimes it is not practical to block a very popular domain.

We believe in the idea of providing security through DNS. Most of the service providers out there are doing a good job, aligned to their proposed missions. But these services are better suited to regular Internet users who simply want some protection for themselves. On the other hand, small businesses, service providers and enterprises require more flexibility and transparency and are more than ever concerned about privacy. The solutions provided by Malware Patrol are better suited for these companies.

Please contact us to set up an evaluation period, during which you can test our DNS RPZ services.

Andre Correa

Founder, Malware Patrol

Andre Correa - Malware PatrolInformation Security and Threat Intelligence Professional whose qualifications include in-depth knowledge of Internet technologies, current cyber security landscape, incident response, security mechanisms and best practices. He founded the Malware Patrol project in 2005. The company is helping enterprises around the world to protect themselves from malware and ransomware attacks through some of the most comprehensive threat data feeds and block lists on the market.

?