Newly-Registered Domains & DGA Infrastructure in Q3 2026 — 5.63M New Domains, 660K DGA-Pattern Clusters, Four-Dimensional Hunt + TaHiTI Playbook

// Q3 2026 · HackForLab Domain Infrastructure Report · October 2026

Newly-Registered Domains Are Not a List · They Are a Stream

In Q3 2026 the HackForLab platform ingested 7.88 million domain indicators of compromise. 5.63 million of them — 71.4% — were first-seen in the quarter. That proportion is the operational signature of a perimeter that no longer sits still long enough to be allow-listed, deny-listed, or hand-triaged. The adversary has shifted from infrastructure as a resource to infrastructure as a flow, and the defender has to shift their detection logic accordingly.

This report decomposes the Q3 2026 domain surface into four hunt dimensions — newly-registered, TLD-abuse divergence, DGA-pattern, and brand-lookalike — and shows how each one maps to a concrete TaHiTI investigation. It names the Q3 top-10 for every dimension, attributes the loudest families, publishes four production-ready Sigma detections, and lays out a 30-day defender workflow. If you only read one domain-infrastructure report this quarter, make it this one.

Executive Brief · What a CISO Needs to Know in 60 Seconds

Three actions a CISO should take before the next quarterly review:

1. Fund an NRD-aware DNS tier. At the proxy, resolver, or SIEM-enrichment layer — pick one. Any first-seen domain in your estate for the first N minutes (we recommend 15–60) should be a soft-block or hunt-alert surface, not a free-pass surface. Of the 15,944 confirmed high-severity domains we catalogued in Q3, the overwhelming majority were younger than 30 days at first user interaction.
2. Treat .xyz, .top, .shop, .cfd, .sbs, .click, .cyou, .lol, .icu, .bond, .monster, .rest as elevated-risk TLDs by policy. We measured a 40× increase in .xyz volume between July and August 2026 alone. The abuse pattern is not evenly distributed — a handful of TLDs disproportionately host campaign infrastructure.
3. Deploy brand-lookalike detection on your own domain and your top five vendor domains. We found 5,467 WhatsApp-token domains, 4,213 Office-token domains, 2,461 Apple-token domains, 1,291 Google-token domains, and 1,032 Amazon-token domains in a single quarter — none of them operated by the real vendors.

Four Questions Every Security Leader Should Have Asked Monday · And Didn’t

If the tiles above landed in your inbox this morning and you did not immediately ask the four questions below, your organisation is not currently postured for the Q4 2026 threat environment. These are not hypothetical. They are the questions boards and audit committees will ask you in the next 90 days.

Why This Matters · The Perimeter Started Moving

Classical perimeter defence assumed the external surface was discrete, nameable, and relatively stable. You could maintain a blocklist, you could enrich at the SIEM, you could run a weekly review cycle. The adversary used domains the way they used buildings: register one, operate it, let it burn, register another. The cadence of that cycle was measured in days or weeks and the defender had time to catch up.

That assumption is dead. Q3 2026 data shows the adversary now treats domains the way they treat payloads: ephemeral, cheap, generated-on-demand, and operated as a pool rather than a list. A single malware family — one we see as the dominant DGA-pattern contributor this quarter — spawned over 390,000 distinct long-random-string subdomains against compromised legitimate parents in 90 days. No blocklist on earth updates fast enough to track that cadence. The defender has to move upstream: from which domains are bad to which structural signatures identify an adversary-generated domain regardless of whether we have seen it before.

The Four-Dimensional Perimeter · A Hunting Taxonomy

To make the stream tractable, we decompose it along four orthogonal dimensions. Each one is a separate decision surface for the defender, each has its own structural telltale, each has its own TaHiTI hypothesis, and each produces a different Sigma rule.

Dimension 1 · The NRD Surface · How It Evolved This Quarter

The newly-registered-domain surface in Q3 2026 is not merely large — it is structured. If you accept that 71% of the domain world your users touch is first-seen-this-quarter, the question becomes: what fraction of that 71% is actually malicious, and what fraction is simply benign newness (legitimate businesses registering, personal projects, redirect chains, marketing campaigns)?

The Severity Distribution

The 15,944 high-severity confirmed malicious domains are where the defender’s attention should start. These are the ones a feed-aware proxy or SIEM should treat as deny-first. The 2.35 million medium-severity entries are decision support: not deny-first material in a mature environment, but strongly weight them in any detonation / sandboxing / risk-scoring pipeline. The 5.51 million low-severity NRD-tier entries are the stream — they are the raw material on which the other three dimensions filter.

What Causes An NRD To Light Up?

Across the Q3 dataset, the strongest predictors of a newly-registered domain graduating from the “watchlist” tier to the “confirmed-malicious” tier are, in order:

1. Registration under an abuse-tier TLD (described in Dimension 2). Roughly 60% of confirmed-malicious NRDs this quarter sit under one of ten abuse-tier TLDs.
2. DGA-pattern stem structure (described in Dimension 3). The long-random bucket produces the single highest promotion rate from NRD to High-sev.
3. Brand-token embedding (described in Dimension 4). Any first-seen domain containing paypal, microsoft, whatsapp, coinbase, okta, docusign, or similar — but not registered to the brand — is a near-certain phishing surface.
4. Dynamic-DNS parent (duckdns, ngrok, workers.dev, herokuapp, azurewebsites). These parents give the adversary free registration, free TLS, and a reputation-washing effect from the parent domain.
5. Nameserver clustering. Multiple fresh registrations sharing a single bulletproof NS record — a passive-DNS pivot even when WHOIS is privacy-shielded.

The practical implication: an NRD-aware DNS tier should not be a binary “new = block”. It should be a weighted scorer that lifts the alert priority as the number of concurrent dimension matches rises. One dimension match is an observation. Two is a hunt. Three is an incident.

Dimension 2 · TLD-Abuse Divergence · The August 2026 Shift

Not every TLD is equal. Measured by abuse-to-legitimate ratio, a small subset of top-level domains host a disproportionate share of adversary infrastructure, and that distribution shifts over time as pricing promotions and takedown pressure reshape adversary economics. Q3 2026 recorded one of the clearest examples we have seen in a trailing year.

Q3 2026 TLD Volume Leaders

The top 15 TLDs by Q3 domain-IOC volume. Note the composition — only four of these (.com, .net, .org, .in) are what one would call “general-purpose business” TLDs. The remainder are abuse-tier at this scale.

The August 2026 Surge · 40× in a Single Month

The abuse-tier TLD volume is not stable. Observed month-over-month, Q3 2026 recorded one of the sharpest surges in abuse-tier concentration we have measured. The table below shows selected abuse-tier TLD volume in July 2026, August 2026, and the ratio of change.

Policy Recommendation · Elevated-Risk TLD Set

We recommend the following TLDs be treated as elevated-risk by DNS, proxy, and e-mail-gateway policy as of Q4 2026. “Elevated-risk” does not mean deny — it means require secondary signal before allowing (user interaction tracked, DGA score computed, brand-token check applied, business justification logged, soft timeout before free passage, or similar).

.xyz.top.shop.online.click.site.store.vip.cfd.icu.sbs.lol.cyou.bond.monster.rest.fun.makeup.quest

Dimension 3 · DGA Pattern Signatures · The Four Structural Buckets

Of the 7.88 million Q3 domain IOCs we analysed, we classified 660,926 distinct domains as structurally algorithmic — i.e., their stems carry linguistic patterns a human-typed domain almost never produces. We decompose that cluster into four buckets, each with its own detection logic.

Structural Bucket Breakdown

The ClearFake Hybrid Pattern · Dominant DGA Signature of Q3

By a large margin, the single most-recurring DGA pattern in Q3 2026 belongs to one malware family (ClearFake). Its characteristic signature is a hybrid of DGA and infrastructure hijack:

The 8-character random prefix is the DGA output. The parent is a legitimate domain the operator has compromised (hosting panel takeover, stale WordPress install, exposed S3 bucket serving the site). From the resolver’s point of view the domain looks “half random, half known-good”, which defeats naive reputation scoring that treats the parent domain as the authoritative risk input.

Representative examples from the Q3 2026 dataset (defanged)

• ojyh0s8b[.]brycecanyonlogcabins[.]com — 8-char prefix + compromised legitimate parent
• n5fdo702[.]www-trumpgoldenbadge[.]com
• 89ulhsid[.]nycsocialsportsclub[.]com
• z9yxj5lc[.]us-morningfatmelter[.]com
• tj6oqmj6[.]creditrepairhacking[.]com
• s0ls07nv[.]www-genesisrevival[.]com
• 4ntdxkko[.]fourstarcampground[.]com
• 73x4a00h[.]us-us-us-zensulin[.]com
• 740h2wzc[.]birthdaygenerator[.]com
• a1r2n20k[.]lorenzboulosgroup[.]com

Structural Clustering Over Time · How DGA Behaviour Evolves

DGA families are not static. Within a 90-day window we can routinely observe three distinct evolution phases in the dominant family:

1. Phase 1 · Burst — a 48–72 hour window where a few thousand candidate domains are registered or compromised simultaneously. The structural signature is tight (narrow stem-length distribution, narrow consonant-ratio distribution).
2. Phase 2 · Spread — the operator distributes those domains to implants in the wild. The signature stays tight but the DNS resolution volume ramps.
3. Phase 3 · Drift — the operator retunes the generator (new seed, new alphabet, new stem length) to defeat the structural rules the defender just deployed. The signature shifts, usually by one measurable feature: a change from 8 to 10 character stems, from all-lowercase to mixed-case, from alnum to alnum-with-dashes.

The implication for the defender: a static structural rule has a half-life measured in weeks. A parametric rule — one that measures stem-length distribution, consonant ratio, bigram entropy, and alerts on statistical deviation from the organisation’s own baseline — survives generator drift. This is why we recommend the Sigma rules in this report be deployed alongside a baselined ML scorer, not instead of one.

Dimension 4 · Brand-Lookalike Hunter · Q3 2026 Hitlist

Brand-lookalike detection catches a different adversary intent than the other three dimensions: direct credential capture through social engineering. The adversary registers a domain that embeds a recognisable brand token because the victim’s trust in the brand pulls their hand onto the login button faster than the victim’s suspicion of the domain can slow them down.

Q3 2026 Brand-Token Lookalike Volume

The Mass-Registered Cluster Pattern

The WhatsApp cluster is instructive. 15 of its most-detected domains were all first-seen on exactly the same day (2026-07-05) with identical structural prefixes (app-<3char>-whatsapp*). That synchronisation is a campaign-ops marker — the operator registered hundreds of domains in a single tool run, then held them for days or weeks until the campaign activated.

Sample defanged entries from the Q3 cluster:

• app-ap-whatsappweb[.]com[.]cn
• app-gyk-whatsappcc[.]com
• app-llv-whatsappcc[.]com
• app-lvf-whatsappcc[.]com
• app-qay-whatsappcc[.]com
• app-skc-whatsappcc[.]com
• app-sug-whatsappcc[.]com
• eswhatsapp[.]cc
• go-net-whatsappweb[.]com[.]cn
• guardwhatsapp[.]com

Threat Actor Attribution · Who Uses NRD and DGA Infrastructure

Across the full 7.88 million Q3 2026 domain dataset, 94% of entries carry no actor attribution — they are catalogued at the “newly-registered-domain” severity tier before a specific adversary has been tied to them. The remaining 6% break into named operator clusters as follows.

Top Named Operators Using Domain Infrastructure in Q3 2026

The APT clusters (UNC1549, UNC6671, UTA0560, BlueNoroff, Dragon Breath) use far fewer domains per quarter than the commodity operators (ClearFake, Lucid, JWR) but each APT domain has a far higher operational cost of discovery for the defender — these are typically only exposed through post-incident forensic analysis, not through automated feed consumption. The surveillance implication: an organisation targeted by one of these clusters typically sees one or two hostnames per engagement, not hundreds, and the detection must come from structural and behavioural patterns rather than exact-match blocklists.

Top 10 Domains Per Type · Q3 2026 IOC Pack

Below are top-10 extracts across six representative types from the Q3 2026 dataset. All domains are shown defanged. These are published for use in enrichment, correlation, and historical lookup — not as a replacement for a live feed subscription.

Top 10 · Confirmed C2 Domains (by detection volume)

Top 10 · DGA-Pattern Domains (long-random bucket, attributed)

Top 10 · TLD-Abuse NRD Samples (abuse-tier TLD, Sept 2026 first-seen)

Note the sequential numbered pattern on the .xyz entries — 040001xxx[.]xyz is the signature of a single tool run producing hundreds of domains with incrementing identifiers. This is a textbook campaign-ops marker and the full subdomain family should be captured together.

Top 10 · Brand-Lookalike Domains (WhatsApp cluster, July 2026)

Top 10 · APT Infrastructure (named cluster domains)

Top 10 · Phishing-Tagged Domains

TaHiTI — How to Hunt NRD and DGA Infrastructure Rigorously

The TaHiTI framework (Targeted Hunting integrating Threat Intelligence) is the methodology we use to turn domain-infrastructure intelligence into a bounded, repeatable, and reviewable hunt. The core TaHiTI pattern separates abstract threat (what adversary behaviour is possible) from concrete hunt (what query produces evidence in your environment) through an explicit investigation abstract that documents hypothesis, data sources, pivots, and success criteria before you touch a keyboard.

The TaHiTI Investigation Abstract for Domain Intelligence

Five TaHiTI Hunt Hypotheses · Q3 2026 Specific

Hypothesis 1 — Any host resolved an NRD within 15 minutes of first-registration

Rationale: a domain resolved within minutes of appearing in the global NRD feed indicates pre-staged infrastructure that the implant was already configured to call out to. This is the strongest signal we have for a malware-triggered DNS query (as opposed to a user-triggered one).

Procedure: join DNS query log (last 24 h, type A/AAAA, successful) against NRD feed (first-seen within past 15 min of query time). Any match goes to the hunt queue.

Hypothesis 2 — Multiple hosts resolved the same DGA-pattern parent in a short window

Rationale: a DGA family compromises many hosts and each host beacons to a slightly different generated subdomain. If you see several hosts resolve different subdomains of the same parent in the same 10-minute window, you have found a DGA campaign in your environment.

Procedure: group DNS queries by parent-domain (strip the first label), filter to parents matching the Q3 ClearFake-class regex (^[a-z0-9]{8}\.), count distinct client IPs per parent. Any count ≥ 2 goes to the hunt queue.

Hypothesis 3 — Any user clicked an abuse-tier TLD within an hour of receiving e-mail

Rationale: the time correlation ties the click to the delivery vector. An abuse-tier TLD being clicked within the first hour of e-mail receipt is the shape of a phishing engagement.

Procedure: join inbound e-mail log (URLs in body, delivery timestamp) against proxy log (URL click, user, click timestamp). Filter to clicks where (click_time – delivery_time) < 60 min and URL host matches an abuse-tier TLD. Any match goes to the hunt queue.

Hypothesis 4 — Any domain embeds our brand or a top-5 vendor brand in a non-authoritative registration

Rationale: catches lookalike / impersonation domains before a user interacts with them. The hunt runs continuously, not reactively.

Procedure: nightly job scans the full NRD feed with regex for each tracked brand token (your own + top-5 vendors), filtered to exclude the brand’s authoritative registrar footprint. Each hit opens an attribution ticket. If TLS cert is issued or MX record is set, the ticket escalates to an active engagement.

Hypothesis 5 — Mass-registered cluster matches our vendor-impersonation watch

Rationale: catches the Q3-style WhatsApp pattern — ten or more domains that share a prefix pattern and a brand token, all registered on the same day.

Procedure: nightly aggregate on prefix pattern + brand token + first-seen date. Any cluster of ≥5 counts the entire family as an actionable set, not individual domains.

TaHiTI in Practice · The Operational Playbook for NRD + DGA Hunts

The earlier TaHiTI section introduced the framework — hypothesis, investigation abstract, pivot plan, success criteria. This section is the playbook: four operational stages, three run-sheets, and the concrete decisions a hunt team makes at each gate. The intent is to give a working CTI function enough structure to run NRD + DGA hunts on the Q3 2026 data this week and still have the artefacts to defend the hunt in a quarterly review next quarter.

The Four TaHiTI Stages · What Each One Owns

TaHiTI treats hunting as a four-stage lifecycle, each with its own entry condition, deliverable, and exit gate. The stages are sequential — you do not start Stage 3 before Stage 2 is signed off — and each stage is explicitly reviewable.

The TMM (TaHiTI Maturity Model) Lens on NRD + DGA Readiness

Where is your hunt program on the TaHiTI maturity curve, specifically for the domain-infrastructure surface this report describes? Honest self-scoring per dimension tells you where to invest the next quarter’s hunting budget.

Three TaHiTI Run-Sheets · Copy, Fill In, Execute

Below are three stage-complete investigation abstracts in TaHiTI form, each anchored to a Q3 2026 finding from this report. Use them as templates — fill in your estate-specific data sources and time windows and the abstract is ready for peer review.

Run-Sheet 1 · “Any host in our estate has resolved a ClearFake-pattern domain in the past 72 hours”

Run-Sheet 2 · “Mass-registered brand-lookalike cluster has been resolved by any user in a time window suggestive of a live phishing campaign”

Run-Sheet 3 · “Abuse-tier TLD volume into our estate has risen above 2× baseline over the past 7 days”

How TaHiTI Compounds · Why Each Hunt Makes the Next One Easier

The reason the TaHiTI framework compounds — the reason the fourth hunt in a quarter is cheaper to run than the first — is the Finalization stage. Every hunt deposits three artefacts the organisation keeps forever:

1. A hunt notebook. Reproducible query, exact data window, exact matches, pivot trail, decisions made. The next analyst to run a similar hunt starts from the notebook, not from a blank page.
2. A hardened detection. If a hunt proved a particular query produces a reliable signal with low false-positive rate, that query is promoted to a scheduled rule. The one-off hunt becomes a standing detection and the hunter does not have to re-execute it.
3. An attribution update. Any infrastructure the hunt touched — parent domains, resolver chains, nameserver clusters, cert fingerprints — is added to the operator-infrastructure graph. Future hunts pivot through that graph in seconds instead of discovering it from scratch.

The 90-Day TaHiTI Deployment Plan for Domain Infrastructure

If your organisation is not currently running TaHiTI-style hunts against the domain surface, the following is a staged plan to be at L3 (Compounding) in one quarter.

If you have run the plan and the fourth hunt takes materially less analyst time than the first, your organisation has entered the compounding regime and the TaHiTI framework is working as designed. From that point onward, every new HackForLab weekly or quarterly advisory becomes a new Trigger that drops into Stage 1 of a hunt your team is already instrumented to execute.

SOC Enablement · Queries, Dashboards, Metrics

Three SPL / KQL / Lucene Queries You Can Run Today

Query 1 · “Any host resolved an NRD this week”

// KQL · Microsoft Sentinel / Defender for Endpoint
DeviceDnsEvents
| where TimeGenerated > ago(7d)
| join kind=inner (
    ExternalData
    | where Source == "NRD_Feed"
    | where FirstSeenUtc > ago(7d)
    | project DomainName, FirstSeenUtc
  ) on $left.QueryName == $right.DomainName
| extend ResolutionDelta = datetime_diff('second', TimeGenerated, FirstSeenUtc)
| where ResolutionDelta < 900
| project TimeGenerated, DeviceName, QueryName, FirstSeenUtc, ResolutionDelta
| summarize ResolveCount=count() by DeviceName, QueryName
| order by ResolveCount desc

Query 2 · “ClearFake 8-char prefix pattern across my DNS log”

// Splunk SPL
index=dns sourcetype=dns:query
| rex field=query "^(?<prefix>[a-z0-9]{8})\.(?<parent>[^.]+\.[^.]+)"
| where isnotnull(prefix) AND match(prefix, "^[a-z0-9]{8}$")
| stats count by prefix, parent, src_ip
| where count > 1
| sort - count

Query 3 · “Clients that resolved abuse-tier TLDs for the first time in 90 days”

// Elastic / Lucene
dns.question.name:(*.xyz OR *.top OR *.shop OR *.cfd OR *.sbs OR *.lol OR *.click OR *.cyou OR *.online OR *.site OR *.store OR *.vip)
AND NOT dns.question.name:(allowlist_known_business_partners.xyz)
AND @timestamp:[now-24h TO now]
AND NOT client.ip IN (dns_cache_resolvers_internal)
| sort @timestamp desc
| aggregate by client.ip, dns.question.name

Three SOC Dashboard Panels We Recommend

1. “Fresh Domain Pressure” — a 7-day rolling line chart of the fraction of all outbound DNS queries from your estate that resolve a domain first-seen in the past 24 hours. The baseline should settle in the low single-digit percent. A rising baseline is a leading indicator that something in your estate is beaconing to algorithmically-generated infrastructure.
2. “TLD Risk Heatmap” — a 2D heatmap: rows are abuse-tier TLDs, columns are departments / business units, cell value is the number of unique clients that resolved that TLD this week. Hunts should start wherever the heat is unusually hot.
3. “NRD-to-Click Latency” — histogram of the delta between a domain’s global first-seen timestamp and the first click from your organisation. The left tail (sub-1-hour clicks) is where the phishing engagements live.

Metrics the Blue Team Should Report Quarterly

Defender’s 30 / 60 / 90-Day Roadmap

Days 1 – 30 · Visibility

• Confirm every outbound DNS query from the corporate estate is logged with client, timestamp, QueryName, QueryType, RCode.
• Subscribe to an NRD feed (commercial or your own TLS-cert-transparency-plus-WHOIS pipeline).
• Pilot the three TaHiTI run-sheets in this report on 1–5% of your estate with logged-only enrichment. Measure base rates and baseline the Fresh-Domain-Pressure metric.
• Baseline the “fresh domain pressure” metric for your organisation. Set the alert threshold at 2× baseline, not an absolute number.

Days 31 – 60 · Detection

• Promote the ClearFake 8-char DGA prefix pivot (Run-Sheet 1) and the brand-lookalike cluster pivot (Run-Sheet 2) from Trigger-review to scheduled TaHiTI hunts on a weekly cadence.
• Deploy brand-lookalike watch on your own domain and your top 5 vendor domains.
• Add abuse-tier TLD elevated-risk policy at the proxy layer. Monitor for business impact — adjust the whitelist of legitimate partners rather than removing the policy.
• Build the three SOC dashboard panels (Fresh Domain Pressure, TLD Risk Heatmap, NRD-to-Click Latency).

Days 61 – 90 · Response

• Promote the abuse-tier TLD surge pivot (Run-Sheet 3) and the NRD-within-15-min hypothesis (TaHiTI Hypothesis 1) to a continuous enrichment-and-alert workflow with incident-handoff SLA defined.
• Define the standing playbook: “Confirmed first-seen domain + user interaction” is a Severity-2 incident with 1-hour SLA.
• Integrate the four Q3 2026 TaHiTI hunt hypotheses into the quarterly hunt calendar — each runs at least once per quarter.
• Review and update the brand-lookalike watch quarterly. Vendors change, your own product names change, the watch must evolve.

Closing · The Perimeter Has Already Moved

The data in this report should land for the CISO as follows: if your blocklist is more than 24 hours old, it is already stale. If your detection logic is based on which domains you have seen rather than which structural signatures identify an adversary-generated domain, you are hunting last week’s campaigns. The 71% first-seen fraction we measured in Q3 2026 is not an anomaly — it is the new baseline. Treat it accordingly.

HackForLab publishes a weekly threat advisory covering the full seven-day IOC and attribution picture, and a quarterly landscape report. Both are available at /category/cyber-threat-intelligence/. If this report was useful, the quickest way to subscribe is to save that URL — new reports land there within hours of publication.

— HackForLab CTI Research, October 2026