[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [DNS](https://unit42.paloaltonetworks.com/category/dns/ "DNS")  
  [DNS](https://unit42.paloaltonetworks.com/category/dns/)

# The Next Level: Typo DGAs Used in Malicious Redirection Chains

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 5 min read  
Related Products  
[![Advanced DNS Security icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced DNS Security](https://unit42.paloaltonetworks.com/product-category/advanced-dns-security/ "Advanced DNS Security")[![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Reethika Ramesh](https://unit42.paloaltonetworks.com/author/reethika-ramesh/)
  * [Janos Szurdi](https://unit42.paloaltonetworks.com/author/janos-szurdi/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:March 6, 2025

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [DNS](https://unit42.paloaltonetworks.com/category/dns/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Domain Generation Algorithms](https://unit42.paloaltonetworks.com/tag/domain-generation-algorithms/)
  * [Malicious Domains](https://unit42.paloaltonetworks.com/tag/malicious-domains/)
  * [Newly Registered Domain](https://unit42.paloaltonetworks.com/tag/newly-registered-domain/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/typo-domain-generation-algorithms/?pdf=download&lg=en&_wpnonce=7052973960 "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/typo-domain-generation-algorithms/?pdf=print&lg=en&_wpnonce=7052973960 "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=The%20Next%20Level:%20Typo%20DGAs%20Used%20in%20Malicious%20Redirection%20Chains&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ftypo-domain-generation-algorithms%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Ftypo-domain-generation-algorithms%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ftypo-domain-generation-algorithms%2F&title=The%20Next%20Level:%20Typo%20DGAs%20Used%20in%20Malicious%20Redirection%20Chains "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ftypo-domain-generation-algorithms%2F&text=The%20Next%20Level:%20Typo%20DGAs%20Used%20in%20Malicious%20Redirection%20Chains "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ftypo-domain-generation-algorithms%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=The%20Next%20Level:%20Typo%20DGAs%20Used%20in%20Malicious%20Redirection%20Chains%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ftypo-domain-generation-algorithms%2F "Share in Mastodon")

## Executive Summary

We have uncovered a new campaign in which an attacker leverages newly registered domains (NRDs) and introduces a new variant of domain generation algorithms (DGAs) potentially designed to avoid detection. We found this through our novel graph-intelligence based pipeline. The system infers attack campaigns by correlating domain registrations with hosting infrastructure, passive DNS and WHOIS data.

This campaign used over 6,000 NRDs that redirected to similar paths on domains resembling those generated by dictionary-based DGAs. Dictionary DGAs are a DGA variant that combines dictionary words to create domain names resembling legitimate ones, thus hindering detection by security systems.

These NRDs redirected users to URLs that lead to advertisements of potentially unwanted Android applications. Analysis of files contacting the NRDs' IP address revealed that 96% (89 of 92) were malicious.

Broadening the scope of our investigation, we found that there were 444,898 NRDs belonging to the same actor. These NRDs redirected to 178 domains exhibiting dictionary DGA-like characteristics.

We identified a new pattern in these 178 domains, which we call typo DGAs: dictionary DGA domains containing typographical errors. For example, pictidentifyive\[.\]pro is a typo DGA that could be a combination of the words "picture," "identify" and "five" with some letters deleted. This typo DGA pattern suggests a new dictionary DGA variant designed to evade traditional detection methods.

Palo Alto Networks customers are better protected through the following products and services:

[Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with this activity as malicious.

If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html).

| **Related Unit 42 Topics** | [**DNS**](https://unit42.paloaltonetworks.com/category/dns/) |
|----------------------------|--------------------------------------------------------------|

## The Typo DGA and Redirection Campaign

Our graph-intelligence based detection system, described in our article [TLD Tracker: Exploring Newly Released Top-Level Domains](https://unit42.paloaltonetworks.com/tracking-newly-released-top-level-domains/), has uncovered a new campaign. This campaign has used 6,057 newly registered domains, each redirecting to paths under various dictionary DGA-like domains.

Figure 1 illustrates a portion of the campaign, specifically three NRDs redirecting to typo DGA subdomains. These subdomains resolve to a malicious IP address that many malicious file samples contacted.
![An illustrative network diagram showing relationships between various internet entities like URLs, IP addresses, domain hashes, and hostnames. The diagram includes nodes connected by lines, with red indicators highlighting entities known to be malicious. Some elements are grouped and detailed to show more complex subrelations, such as epoch timestamp subdomains.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-276073-138551-1.png) Figure 1. Part of the campaign depicting three NRDs redirecting to typo DGA subdomains.

### Shared WHOIS Information

The 6,057 NRDs were alphanumeric strings resembling DGAs, with five to six characters. These domains all shared the same WHOIS information including registrant email address (fangyuanhenry20230927@outlook\[.\]com), which confirms that the same entity registered them.

Figure 2 shows that all the NRDs logged at the time of campaign detection were registered between August-November 2024.
![Bar chart showing the number of domains from August 2024 to November 2024. The data shows a significant increase from 195 in August to 2,634 in October, before dropping to 1,172 in November. Palo Alto Networks and Unit 42 logo lockup.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-280431-138551-2.png) Figure 2. Creation dates of all 6,057 NRDs found in the campaign.

### Shared Hosting Infrastructure

We identified this campaign because these NRDs share the same malicious hosting infrastructure and resolve to the same IP address 91.195.240\[.\]123.

### Redirection to URLs Under Typo DGA Subdomains

Subdomains of these NRDs redirected to URLs under typo DGAs. In this campaign, the typo DGA subdomains used [epoch timestamps](https://en.wikipedia.org/wiki/Unix_time). These timestamps correspond to the observed redirection times. For example, we observed hxxps://121.y1ly6n\[.\]us redirecting to hxxps://1731804190472.gratsuccessfic\[.\]pro on Nov. 17, 2024, at 00:45:19 UTC.

The epoch timestamp 1731804190472 represents a time two minutes earlier. These epoch timestamp subdomains suggest that the NRD domain registrations and redirections might have been automated and scheduled to trigger at certain times of the day.

### Landing Pages

The NRDs' landing pages presented adult Android app download pages (shown in Figure 3). The NRDs all resolved to the same IP address mentioned above, 91.195.240\[.\]123. Furthermore, over 96% of the samples (89 of 92) contacting this IP address were malicious executable files.
![Smartphone screen displaying a pop-up advertisement featuring an animated silhouette of a woman. The ad includes various Chinese text with a prominent yellow button at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-283786-138551-3.png) Figure 3. Example landing page with adult content distributing potentially unwanted applications.

## Using the Threat Actor's Infrastructure to Expand Detection

We used our graph-intelligence pipeline to search for domains with similar characteristics, expanding the coverage of the campaign. Using the same registrant email address identified above, we identified 444,898 domains. Our passive DNS data shows that nearly all of these (99.98%, or 444,827 domains) resolved to the same IP address (91.195.240\[.\]123). This strong correlation suggests a broader network of potentially malicious activity, even if not all domains are directly involved in this campaign.

Figure 4 shows that the distribution pattern of the domain creation dates suggests that the attacker registered several thousand domains over multiple weeks, followed by periods of reduced activity. The short lifespan of the landing pages and redirection behavior suggests a rapid domain turnover strategy.
![Bar graph showing the number of domains created over time, with data from WHOIS. The x-axis represents creation dates, spanning multiple years, and the y-axis shows the number of domains, reaching up to 2,000 at peaks.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/word-image-287508-138551-4.png) Figure 4. Creation dates of 444,898 domains belonging to the same actor.

Many of these NRDs redirected to 178 distinct typo DGA domains, also employing epoch timestamps in their subdomains. We haven't found direct evidence linking these typo DGA domains to the same actor controlling the NRDs (e.g., shared WHOIS or hosting). However, the consistent use of the less common .pro TLD across all 178 domains warrants further investigation.

Furthermore, we found an average of 67 different epoch timestamp subdomains under each typo DGA root domain, which suggests at least that many distinct redirection events.

## Conclusion

Our analysis revealed a campaign using typo DGAs, which is a novel dictionary DGA variant designed to evade detection. This campaign highlights the need for advanced detection capabilities like our graph intelligence pipeline. We are actively monitoring and blocking the malicious infrastructure in the campaign we described (tracked as [**'typodga\_redir'**](https://urlfiltering.paloaltonetworks.com/campaign/?q=typodga_redir)).

Palo Alto Networks customers are better protected through the following products and services:

[Advanced URL Filtering](https://docs.paloaltonetworks.com/advanced-url-filtering/administration) and [Advanced DNS Security](https://docs.paloaltonetworks.com/dns-security) identify known domains and URLs associated with this activity as malicious.

If you think you may have been compromised or have an urgent matter, get in touch with the[Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
* UK: +44.20.3743.3660
* Europe and Middle East: +31.20.299.3130
* Asia: +65.6983.8730
* Japan: +81.50.1790.0200
* Australia: +61.2.4062.7950
* India: 00080005045107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org).

## Indicators of Compromise

### NRDs

* zgi8ij\[.\]us
* ord8w1\[.\]us
* mg77bi\[.\]us
* wnsukh\[.\]us
* y1ly6n\[.\]us
* fdca5\[.\]us
* xwc30\[.\]us
* sloe2\[.\]us

### IP Address

* 91\.195.240\[.\]123

### Typo DGA Domains

* pictidentifyive\[.\]pro
* gratsuccessfic\[.\]pro
* emesispushship\[.\]pro
* everybodyform\[.\]pro
* brontalreadyture\[.\]pro

## Additional Resources

* [Fast Flux 101: How Cybercriminals Improve the Resilience of Their Infrastructure to Evade Detection and Law Enforcement Takedowns](https://unit42.paloaltonetworks.com/fast-flux-101/) --- Unit 42, Palo Alto Networks
* [Newly Registered Domains: Malicious Abuse by Bad Actors](https://unit42.paloaltonetworks.com/newly-registered-domains-malicious-abuse-by-bad-actors/) -- Unit 42, Palo Alto Networks
* [Threat Brief: Understanding Domain Generation Algorithms (DGA)](https://unit42.paloaltonetworks.com/threat-brief-understanding-domain-generation-algorithms-dga/) -- Unit 42, Palo Alto Networks
* [TLD Tracker: Exploring Newly Released Top-Level Domains](https://unit42.paloaltonetworks.com/tracking-newly-released-top-level-domains/) -- Unit 42, Palo Alto Networks

Back to top

### Tags

* [Domain Generation Algorithms](https://unit42.paloaltonetworks.com/tag/domain-generation-algorithms/ "Domain Generation Algorithms")
* [Malicious Domains](https://unit42.paloaltonetworks.com/tag/malicious-domains/ "Malicious Domains")
* [Newly Registered Domain](https://unit42.paloaltonetworks.com/tag/newly-registered-domain/ "Newly Registered Domain")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems](https://unit42.paloaltonetworks.com/detect-block-malicious-traffic-distribution-systems/ "Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems")

### Table of Contents

* 

### Related Articles

* [Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ "article - table of contents")
* [One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks](https://unit42.paloaltonetworks.com/graph-neural-networks/ "article - table of contents")
* [Effective Phishing Campaign Targeting European Companies and Organizations](https://unit42.paloaltonetworks.com/european-phishing-campaign/ "article - table of contents")

## Related DNS Resources

![Pictorial representation of Azure OpenAI DNS resolution issue. Futuristic cityscape illustration with luminous structures and floating cloud elements, showcasing advanced technology and a dynamic, digitally enhanced environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/02_DNS_Overview_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) January 20, 2026 [#### DNS OverDoS: Are Private Endpoints Too Private?](https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/)

* [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure")

* [Networking](https://unit42.paloaltonetworks.com/tag/networking/ "networking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dos-attacks-and-azure-private-endpoint/ "DNS OverDoS: Are Private Endpoints Too Private?")  
  ![Pictorial representation of Azure OpenAI DNS resolution issue. Futuristic cityscape illustration with luminous structures and floating cloud elements, showcasing advanced technology and a dynamic, digitally enhanced environment.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/06/02_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 3, 2025 [#### Lost in Resolution: Azure OpenAI's DNS Resolution Issue](https://unit42.paloaltonetworks.com/azure-openai-dns-resolution/)

* [Endpoint](https://unit42.paloaltonetworks.com/tag/endpoint/ "endpoint")

* [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/azure-openai-dns-resolution/ "Lost in Resolution: Azure OpenAI's DNS Resolution Issue")  
  ![Pictorial representation of detecting and blocking malicious traffic distribution systems. A digital illustration of a glowing globe centered on North America, surrounded by multiple smaller globes, all connected with lines on a dark blue high-tech background, representing global connectivity and network technology.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/03/03_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 5, 2025 [#### Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems](https://unit42.paloaltonetworks.com/detect-block-malicious-traffic-distribution-systems/)

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")

* [Redirection](https://unit42.paloaltonetworks.com/tag/redirection/ "Redirection")

* [Web attacks](https://unit42.paloaltonetworks.com/tag/web-attacks/ "web attacks")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/detect-block-malicious-traffic-distribution-systems/ "Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems")  
  ![Pictorial representation of detecting DNS hijacking. Digital illustration of a futuristic data center with glowing blue server racks connected by light beams, surrounded by cloud computing icons, set against a dark background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/02_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 4, 2024 [#### Automatically Detecting DNS Hijacking in Passive DNS](https://unit42.paloaltonetworks.com/detect-dns-hijacking-passive-dns/)

* [Domain hijacking](https://unit42.paloaltonetworks.com/tag/domain-hijacking/ "domain hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/detect-dns-hijacking-passive-dns/ "Automatically Detecting DNS Hijacking in Passive DNS")  
  ![Pictorial representation of DNS tunneling detection. Digital illustration of a padlock icon symbolizing cybersecurity, superimposed on a grid comprised of interconnected glowing lines and dots, depicting a global network.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/08_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) October 4, 2024 [#### No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection](https://unit42.paloaltonetworks.com/detecting-dns-tunneling-campaigns/)

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [DNS tunneling](https://unit42.paloaltonetworks.com/tag/dns-tunneling/ "DNS tunneling")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/detecting-dns-tunneling-campaigns/ "No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection")  
  ![A visual representation of top level domain tracking. Close-up view of a modern data center with rows of illuminated server racks.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/08/10_DNS_Category_1505x922-718x440.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 30, 2024 [#### TLD Tracker: Exploring Newly Released Top-Level Domains](https://unit42.paloaltonetworks.com/tracking-newly-released-top-level-domains/)

* [Malicious Domains](https://unit42.paloaltonetworks.com/tag/malicious-domains/ "Malicious Domains")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/tracking-newly-released-top-level-domains/ "TLD Tracker: Exploring Newly Released Top-Level Domains")  
  ![A pictorial representation of deepfake scams. A digital fingerprint integrated into a blue circuit board with glowing lights, illustrating concepts of cybersecurity and technology.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/08/11_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 29, 2024 [#### The Emerging Dynamics of Deepfake Scam Campaigns on the Web](https://unit42.paloaltonetworks.com/dynamics-of-deepfake-scams/)

* [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI")

* [Scams](https://unit42.paloaltonetworks.com/tag/scams/ "Scams")

* [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dynamics-of-deepfake-scams/ "The Emerging Dynamics of Deepfake Scam Campaigns on the Web")  
  ![A pictorial representation of using autoencoders to detect malicious DNS traffic. Three transparent blocks with glowing letters "D," "N," and "S" on a circuit board background with blue and purple lighting.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/08/01_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 21, 2024 [#### Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic](https://unit42.paloaltonetworks.com/profiling-detecting-malicious-dns-traffic/)

* [Malicious Domains](https://unit42.paloaltonetworks.com/tag/malicious-domains/ "Malicious Domains")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [Machine Learning](https://unit42.paloaltonetworks.com/tag/machine-learning/ "Machine Learning")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/profiling-detecting-malicious-dns-traffic/ "Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic")  
  ![Conceptual illustration of a digital data center with glowing blue networks and holographic clouds above server racks, representing cloud computing infrastructure and data storage.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/02_DNS_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) May 13, 2024 [#### Leveraging DNS Tunneling for Tracking and Scanning](https://unit42.paloaltonetworks.com/three-dns-tunneling-campaigns/)

* [DNS tunneling](https://unit42.paloaltonetworks.com/tag/dns-tunneling/ "DNS tunneling")

* [Scanning](https://unit42.paloaltonetworks.com/tag/scanning/ "scanning")

* [Tracking](https://unit42.paloaltonetworks.com/tag/tracking/ "tracking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/three-dns-tunneling-campaigns/ "Leveraging DNS Tunneling for Tracking and Scanning")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)