DNS Abuse and Redirection: Enough for a New JS Malware to Hide Behind?

A JavaScript (JS) malware sporting the same tactic as Decoy Dog’s¹—redirection via Google Public DNS abuse—has been plaguing site owners by leading their unwitting visitors to tech support scam websites.²

Traffic redirection via DNS abuse to hide traces of malicious activity seems to be gaining ground as a common cybercriminal tactic. Sucuri has, in fact, identified 35 indicators of compromise (IoCs) comprising 30 domains and five IP addresses related to the latest threat.

To determine if there could be more connected artifacts, WhoisXML API dove deeper into the threat aided by our exhaustive DNS intelligence. That led to the discovery of:

• Two unreported IP addresses to which some domains identified as IoCs resolved
• 330 domains that shared the dedicated IP addresses identified as IoCs and the additional ones we found as hosts, 157 of which turned out to be malicious according to a bulk malware check
• 101 domains that contained some of the strings found among those identified as IoCs

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

—

• [1] https://main.whoisxmlapi.com/threat-reports/decoy-dog-too-sly-to-leave-dns-traces
• [2] https://blog.sucuri.net/2023/08/from-google-dns-to-tech-support-scam-sites-unmasking-the-malware-trail.html