A digital network visualization featuring interconnected lines and nodes with glowing red lights, depicting the economic benefits of DomainTools Internet Intelligence in a complex and futuristic data network on a dark background.
A professional man, wearing glasses, intently reads a digital tablet beside the cover of "the Economic Benefits of DomainTools Internet Intelligence" on patterns of malicious infrastructure, spring 2024 edition.
DomainTools Reports

The DomainTools Report: Spring 2024 Edition

Large-Scale Patterns of Malicious Online Infrastructure

In the Spring 2024 edition of the DomainTools Report, we again focus on concentrations of malicious activity by the six categories we last studied in the Spring 2023 edition: Top Level Domain (TLD), IP Autonomous System Number (ASN), Name server ASN, Domain Registrar, Country of Hosting, and SSL Certificate Issuer. For each category, we provide a Top Ten list sorted by signal strength (a measure of the concentration of malicious activity). Many of the items on these lists will look familiar to practitioners, but the report holds some surprises as well.

We identify these “hotspots” of malicious activity in part to point investigators and researchers toward forensic data points that will be useful in helping make sense of Internet infrastructure of unknown quality or nature. 

This paper includes:

  • The methodology for the research
  • A series of “Top Ten” tables for each of the six features studied
  • Findings: expected, and unexpected, patterns in the data