The Assembly Line Behind 1.5 Million Malicious Domains

Why It Matters

The concentration of domain abuse means that focused anti‑abuse policies at a handful of registrars and hosting providers can dramatically reduce the attack surface for phishing, credential harvesting, and malware distribution, protecting millions of end users.

Key Takeaways

• Attackers created ~1.5 M domains, 90% new, in first five months
• Four registrars host over one‑third of all malicious domains
• .com, .top, .cc, .xyz together cover two‑thirds of abuse
• Cloudflare IPs serve >230k attack domains each, hiding origins
• WhatsApp appears in ~20k phishing domains, leading brand impersonation

Pulse Analysis

The scale of domain‑based attacks in early 2026 is unprecedented. Over 1.5 million malicious domains surfaced on VirusTotal in just five months, a volume that rivals the output of large‑scale botnets. Most of these domains were registered by threat actors and activated within days, giving defenders a narrow window to intervene. This rapid turnover mirrors an industrial assembly line, where speed and volume outweigh sophistication, and underscores the need for real‑time detection tools that can flag newly registered domains before they are weaponized.

A striking feature of the research is the extreme concentration of abuse across a few registrars, top‑level domains, and hosting networks. Four registrars alone account for more than one‑third of the malicious registrations, while the .com, .top, .cc and .xyz extensions together host roughly two‑thirds of the threat landscape. On the hosting side, Cloudflare’s shared IP infrastructure serves over 230,000 distinct attack domains per address, effectively cloaking malicious sites behind reputable services. This clustering creates natural chokepoints: applying stricter rate‑limits, bulk‑registration monitoring, and rapid takedown protocols at these registrars and CDNs could disrupt a disproportionate share of the malicious ecosystem.

For defenders, the path forward is clear. Implementing automated bulk‑registration alerts, enforcing tighter anti‑abuse checks at the identified registrars, and expanding abuse‑reporting pipelines with Cloudflare and AWS can accelerate domain takedowns. Prioritizing sinkholing of the handful of high‑traffic domains—some receiving billions of DNS queries—will immediately reduce user exposure. Moreover, continuous monitoring of brand‑impersonation patterns, especially for high‑value targets like WhatsApp and Google, can preempt phishing campaigns. By focusing on these concentrated vectors, the industry can transform the current production‑line model of domain abuse into a more defensible landscape.