Advanced DNS Security for Route 53

• Inline detectors—Evaluate DNS queries in the resolution path and provide instant verdicts. These detectors identify known malicious domains from the Palo Alto Networks threat signature database, detect DGA patterns, and identify inline DNS tunneling attempts. DGA detection operates with a fail-open architecture—if a verdict isn't returned within 4 milliseconds, the query resolves normally to ensure workload availability.
• Real-time detectors—Monitor DNS queries off-path and generate threat signals within seconds. These detectors identify advanced tunneling, DNS rebinding, fast-flux patterns, and misconfigured domains by analyzing query patterns and DNS response behavior in real-time.
• Offline detectors—Analyze domain patterns passively to identify threats that require longer observation windows. These detectors identify domain squatting, strategically-aged domains, stockpiled domains, domain shadowing, malicious traffic distribution systems, phishing domains, and ransomware domains.

• Command and Control Domains—Domains used by malware to communicate with attacker-controlled infrastructure for receiving instructions, exfiltrating data, or downloading additional payloads. Blocking C2 domains disrupts an attacker's ability to maintain persistence in your environment.
• Malware Domains—Domains that host, distribute, or facilitate the delivery of malicious software, including exploit kits, ransomware droppers, and trojan delivery networks. These domains are identified through a combination of signature matching and behavioral analysis.
• Phishing Domains—Domains that impersonate legitimate organizations to steal credentials, personal information, or financial data. Detection covers domains that mimic login pages, payment portals, and other trusted services through typosquatting, homograph attacks, or domain shadowing techniques.
• Dynamic DNS (DDNS) Hosted Domains—Domains registered with dynamic DNS providers that allow rapid IP address changes. Threat actors frequently use dynamic DNS services to host malicious infrastructure because these services enable rapid rotation of hosting addresses to evade IP-based blocking.
• Newly Registered Domains—Domains registered within the past 32 days. Attackers often register fresh domains for campaigns because newly registered domains have no reputation history, making them harder to detect through traditional reputation-based methods.
• Grayware Domains—Domains associated with applications that are not directly malicious but exhibit unwanted behavior such as excessive tracking, unsolicited advertising, browser hijacking, or bundled software installation. Grayware domains often operate in a legal gray area while degrading user experience and security posture.
• Parked Domains—Domains that display placeholder content, advertising, or "for sale" pages rather than legitimate services. Attackers purchase expired or abandoned parked domains to leverage their residual reputation and redirect visitors to malicious content.
• Proxy Avoidance and Anonymizers—Domains that provide services designed to bypass network security controls, including web proxies, VPN services, and anonymizing networks. Endpoints contacting these domains may indicate attempts to circumvent your organization's security policies.
• Ad Tracking Domains—Domains used by advertising networks and third-party trackers to monitor user activity across websites and applications. While not inherently malicious, these domains create privacy risks and can serve as vectors for malvertising campaigns that deliver malware through compromised ad networks.