Insights from trillions of DNS queries expose the industrialized criminal ecosystem reshaping modern cybercrime
SANTA CLARA, Calif., July 31, 2026 (GLOBE NEWSWIRE) — Infoblox, the leading platform for preemptive security and critical network services, today announced the release of its 2026 Threat Landscape Report, revealing that cybercrime has evolved into an industrialized criminal economy that enables attackers to operate faster, scale more efficiently and evade traditional defenses. Frontier AI, specialized criminal services and hidden infrastructure are accelerating this transformation, compressing the time defenders have to respond, and exposing the limits of traditional detect-and-respond security strategies.
The report examines cybercrime through four dimensions: the industrialized services powering attacks at scale, the hidden infrastructure enabling evasion, the evolving lures reaching victims and the expanding attack surfaces opening new footholds inside the enterprise. Together, these four perspectives reveal how modern cybercrime operates and what organizations must do to stay ahead of it.
Drawing on trillions of DNS queries, billions of underground criminal transactions and extensive threat research, Infoblox Threat Intel identified the trends reshaping how modern cybercrime operates, finding that:
- Nearly 25 percent of 120 million newly observed domains were high or critical risk, reflecting the massive scale of disposable infrastructure fueling modern cybercrime.
- The most prevalent threat, impacting more than 95 percent of networks, was traffic distribution systems (TDSs), ubiquitous and difficult-to-detect infrastructure that routes victims to targeted malware, phishing and scam attacks.
- 88 percent of threat-related domains were observed in only one customer environment, while 44 percent were active for just a single day, illustrating the scale of domain weaponization and the growing reliance on short-lived infrastructure designed to outpace defenders.
- 65 percent of Infoblox Threat Defense™ customers queried domains associated with residential proxy networks, which attackers use to disguise malicious activity as legitimate consumer internet traffic, allowing attacks to blend into everyday internet activity and evade detection.
- Scam-related domains increased 62 percent year over year, driven by brand impersonation, identity theft and financial fraud.
“This year’s report documents the cybercrime machine, a globally connected criminal economy where frontier AI, specialized criminal services and hidden infrastructure have transformed how attacks are created, purchased and deployed,” said Dr. Renée Burton, vice president, Infoblox Threat Intel. “The most important shift is not that attackers have become more sophisticated. It’s that sophisticated capabilities have become widely accessible, changing the pace of cybercrime and challenging security strategies built primarily around detection and response.”
The report illustrates how cybercrime has evolved from isolated attacks into an interconnected criminal ecosystem fueled by specialization, automation and shared infrastructure. As these capabilities continue to spread, organizations must rethink long-held assumptions about how cyberthreats emerge, spread and can be disrupted.
Read the blog or download the 2026 Threat Landscape report here.
About Infoblox
Infoblox is a leading platform for preemptive security and hybrid, multi-cloud networking that delivers enterprise resilience and agility. Trusted by over 5,700 customers, including the majority of Fortune 100 companies as well as emerging innovators, we seamlessly integrate, secure and automate critical network services so businesses can move fast without compromise. Visit infoblox.com, or follow us on LinkedIn.
Media Contact
Ariel Roop
Head of Global Communications
pr@infoblox.com
