Decoy Dog has gained renown for its ability to abuse the DNS to evade detection and consequent removal. Is it too sly, though, to leave even the tiniest traces behind?

Infoblox identified 23 Decoy Dog indicators of compromise (IoCs) comprising 11 domains and 12 IP addresses in an in-depth analysis report they published in April 2023.¹

In a bid to uncover unreported potentially connected threat artifacts to make the Internet safer and more transparent, the WhoisXML API research team scoured the DNS for more signs of Decoy Dog.

Our deep dive led to the discovery of:

• Two IP address resolutions not on the current list of IoCs that turned out to be malicious based on malware checks
• 90 domains hosted on five dedicated IP addresses identified as Decoy Dog IoCs, four of which were categorized as malicious by a bulk malware check
• 2,295 domains containing the strings cbox4, ignorelist, claudfront, allowlisted, maxpatrol, atlas + upd, hsps, nsdps, ads + tm + glb, and hsdps found in 10 of the domains identified as IoCs, five of which turned out to be malware hosts based on a bulk malware check

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

—

• [1] https://insights.infoblox.com/resources-whitepaper/infoblox-whitepaper-decoy-dog-is-no-ordinary-pupy-distinguishing-malware-via-dns