DNSFilter’s Latest Security Report Finds New Domains Driving Threat Activity

Data shows bad actors increasingly using small nations’ domains for malicious activity

WASHINGTON, D.C. – July 31, 2025 – DNSFilter announced today the release of its latest security report, which finds that bad actors are increasingly using domains associated with smaller island nations to attempt threat activity. Additionally, the report finds that new domains continue to be the most popular threat mode for bad actors for the second consecutive quarter. Download The DNS Record: Q3 Security Report 2025 here. 

Analysis of threat traffic between April 1 and June 30, 2025 also found that malware and phishing continue to grow, with the former accounting for the second most trafficked threat category. The DNSFilter network processed billions more DNS queries in Q2 2025 compared to the previous quarter, with June recording the highest DNS traffic volume of the quarter. Each blocked malicious request represents a real attack prevented, real harm avoided and real people and organizations protected.

Key findings from the report include: 

• Almost 4% of DNS traffic was blocked, marking the highest percentage of blocked traffic on record. Not all blocked traffic is malicious, but this indicates DNSFilter’s users are more regularly blocking domains, whether to avoid cyber threats or block sites associated with time-wasting or inappropriate content. 
  
  
• New domains accounted for nearly 40% of requests categorized as malicious. While this was down slightly from the prior quarter, it indicates that bad actors continue to rely on new domains to capitalize on trends with catchy domain names to customize their threat campaigns. When domains are new, they’ve not yet had time to appear on block lists, which gives bad actors time for exploitation. 
  
  
• Phishing and deception roared back. After a slight dip, phishing and deception (31.6%) marked an increased percentage of traffic on DNSFilter’s network compared to the prior quarter. That represented over 750 million queries, which could be attributed to an increase in sophisticated Phishing-as-a-Service techniques, such as Tycoon 2FA.
  
  
• Island nations’ domains gain traction with bad actors: Of the top five country code Top Level Domains (ccTLDs) likely to be malicious, four were domains associated with island nations. Domains associated with the Faroe Islands (.fo) were number one, with 27% of traffic deemed malicious. Also high on the list were Grenada, Mayotte and Wallis and Futuna. Threat actors adopt new TLDs for use in their campaigns and often choose TLDs and registries that are cheaper or even free in some cases, allowing them to quickly move on from domains and register new ones without cost concerns. 

Ken Carnesi, CEO and co-founder, DNSFilter, said: “Bad actors are agile, and the volume and variation of threats we saw in Q2 underscore that defenders must move as quickly and flexibly as attackers. Blocking new domains, which continue to drive threat traffic, remains a key defensive approach that can mitigate risk from emerging domains that bad actors are trying to weaponize quickly. We’re seeing a structural shift in how modern attacks are launched and sustained and defenders must take notice.”

About the company:

DNSFilter is a cybersecurity company that protects every click, leveraging AI-driven content filtering and threat protection to block threats 10 days earlier than competitors. DNSFilter’s solution secures workers anywhere they are, helping to boost productivity, minimize compliance risk, and protect corporate brands on public Wi-Fi networks. Unlike traditional filtering solutions, DNSFilter deploys in minutes instead of days and is trusted by more than 43,000 organizations worldwide. Learn more about how DNSFilter is the first and last line of defense for corporate and hybrid networks at dnsfilter.com.

Media Contact

Shannon Van Every

Force4 Technology Communications

Shannon@force4.co