DNSFilter Annual Security Report 2025

Keypoints

• Most cybersecurity vendor reports are structured into sections such as forewords, industry news reviews, trend analyses, regional threat assessments, current event spotlights, and conclusions, providing comprehensive insights into threat landscapes and organizational responses.
• Key statistics from 2024 include a 36% increase in malicious activity on networks, with threat queries constituting over 0.41% of all DNS traffic, translating to roughly 92 million threat queries daily—indicating a significant rise in attack volume.
• Phishing saw a remarkable jump of 203%, making it the most common method for distributing ransomware and malware, emphasizing the increasing sophistication and prevalence of email-based threats.
• Threats related to AI, especially scams exploiting generative AI domains, increased by 786% in traffic, with a notable rise in fraudulent AI-related domains that mimic legitimate services for malicious purposes.
• Regionally, Germany, Czech Republic, Italy, Switzerland, and Poland recorded the highest percentage of malicious requests, often due to hosting infrastructure exploited by cybercriminals, while the US remained above average in threat exposure at 0.47%.
• The analysis of TLDs reveals that threats primarily use popular domains like .com and targeted malicious domains like .foo, .co, and ccTLDs such as .sx and .tf, which are favored for their low-cost registration and less regulation.
• Managed Service Providers tend to block categories such as malware, phishing, and cryptomining more aggressively, with policies differing from non-MSPs in categories like advertising and entertainment, reflecting their focus on threat mitigation versus user access flexibility.
• Current events such as major IT outages, hurricane seasons, and elections have been exploited by threat actors for scams, phishing, and malware campaigns, with notable spikes in malicious domains related to these incidents, demonstrating how real-world crises influence cyberattack tactics.
• Law enforcement successes, increased hijacking of malicious domains, and shifts in threat actor behavior underscore the importance of proactive, intelligence-driven cybersecurity strategies that adapt to evolving attack vectors and geopolitical tensions.