Automatically Detecting DNS Hijacking in Passive DNS
Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.
Unit 42 processes roughly 167 million new DNS records daily and applies a machine learning model using 74 features over 169 TB of passive DNS and geolocation data to flag hijacked domains. From March to September 2024 the pipeline screened over 29 billion records and classified 6,729 as DNS hijacking, averaging 38 detections per day; a new model detects hijacks in customer traffic within about 10 minutes. Notable cases include a Hungarian political party's hijacked domain, defacement of a large utility company and ISP, and university and research center domains repurposed for illicit gambling. DNS hijacking typically relies on stolen registrar or DNS provider credentials or cache poisoning, enabling MitM attacks, phishing, drive-by downloads, and scams.
- Pipeline processed 29B+ DNS records, flagging 6,729 as hijacks (Mar-Sep 2024)
- 74 features from 169 TB passive DNS and geolocation data feed the ML model
- Cases include Hungarian political party, utility/ISP defacement, university gambling domains
- Hijackers steal registrar/DNS provider credentials or poison caches to redirect victims
- New model detects customer-traffic hijacking in about 10 minutes
- Victims
- Hungarian political party
- Organizations
- Unit 42Palo Alto Networks
- Countries
- Hungary
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ccdc.org.do | .59.255[.]10 after DNS hijacking. Additionally, we detected ccdc[.]org[.]do , which also resolved to 139.59.255[.]10 on June 28, in |
| domain | c-sharp.in | 9.59.255[.]10 from Singapore for a research center’s domain c-sharp[.]in . This new IP address was suspicious because c-sharp[.]in |
| domain | dkujpest.hu | cal opposition to the Hungarian government, owns the domain dkujpest[.]hu . This domain has been using IP addresses from the 37.9.1 |
| domain | gyumolcstarhely.hu | The nameservers for the domain for several years were: Ns1.gyumolcstarhely[.]hu Ns2.gyumolcstarhely[.]hu Ns3.gyumolcstarhely[.]hu Ns1.web |
| domain | ns1.csit-host.com | hanged, its nameservers (i.e., NS records) were hijacked to ns1[.]csit-host[.]com and ns2[.]csit-host[.]com . Both of the nameservers res |
| domain | ns2.csit-host.com | .e., NS records) were hijacked to ns1[.]csit-host[.]com and ns2[.]csit-host[.]com . Both of the nameservers resolved to the same hijacked |
| domain | uts.ac.id | tential domains to hijack. In a similar case, we found that uts[.]ac[.]id (a university's domain) started resolving to a Singapor |
| domain | webonic.hu | [.]hu Ns2.gyumolcstarhely[.]hu Ns3.gyumolcstarhely[.]hu Ns1.webonic[.]hu, ns2.webonic[.]hu Ns3.webonic[.]hu These nameserver domai |
| domain | websupport.hu | tack, the domain operators switched the nameservers to: Ns1.websupport[.]hu Ns1.websupport[.]hu Ns1.websupport[.]hu We hypothesize th |
| domain | zone-h.org | ked into recent hacking incidents for this IP address using Zone-H[.]org . Figure 7 shows two instances of web page defacement inv |
| ipv4 | 103.84.194.81 | r, the domain has exclusively used an Indonesian IP address 103.84.194[.]81 since 2017. We also observed that the hijacker added many |
| ipv4 | 135.148.57.147 | 6[.]210 . We also found that the domain briefly resolved to 135.148.57[.]147 , another German IP address. These IP addresses are in a |
| ipv4 | 139.59.255.10 | d On the second of April 2024, we detected a new IP address 139.59.255[.]10 from Singapore for a research center’s domain c-sharp[.]i |
| ipv4 | 152.70.176.210 | dkujpest[.]hu suddenly resolved to a new German IP address 152.70.176[.]210 . We also found that the domain briefly resolved to 135.1 |
| ipv4 | 159.223.92.20 | riginal nameservers resolved to the hijacker's IP address ( 159.223.92[.]20 ) during the attack. Like in the previous case, our web c |
| ipv4 | 159.223.92.200 | ity's domain) started resolving to a Singaporean IP address 159.223.92[.]200 on Jan. 13, 2024. However, the domain has exclusively use |
| ipv4 | 176.9.24.28 | ement companies in the U.S. pointing to a new IP address at 176.9.24[.]28 . The FTP service of the website was particularly suspici |
| ipv4 | 208.91.198.24 | because c-sharp[.]in had been using a U.S.-based IP address 208.91.198[.]24 since 2014. Our web crawler found that DNS hijackers chan |
From the original article
12 min read at unit42.paloaltonetworks.com
In this article, we explain our process of detecting domain name service (DNS) hijacking and provide some notable examples of this detection from the first half of 2024. DNS hijacking allows cybercriminals to modify DNS records of domain names and redirect users to malicious servers.
By Moe Ghasemisharif, Janos Szurdi, Daiping Liu, Zhanhao Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.