At ThreatSTOP, our mission is to provide continuous, proactive protection against evolving cyber threats. Over the past month, our Security, Intelligence, and Research (SIR) team has implemented several key updates designed to improve visibility, accuracy, and long-term protection across our DNS Defense Cloud, DNS Defense, and IP Defense platforms. These changes enhance your ability to identify, block, and respond to malicious activity before it impacts your environment.

Classification and Retention Updates

Apple Private Relay FQDNs – Domains

This target has been reclassified from General to the Anonymous Proxy category. This change ensures better alignment with detection standards and helps clarify reporting for customers monitoring privacy-related traffic. No customer action is required and no policy impact is expected.

Extended Retention for Malware Targets

We’ve extended the data retention period for several malware-related targets to better capture long-lived infections and delayed callbacks. The following feeds now retain Indicators of Compromise (IOCs) for a longer duration:

  • Active Malware – Domains

  • TS Originated Manual Malware Domain List – Domains

  • Active Malware – IPs

  • TS Originated Manual Malware IP List – IPs

  • Dormant Malware – Domains

  • Dormant Malware – IPs

This enhancement ensures that longer-running infections remain visible and actionable within your protection window.

Phishing Target Improvements

All phishing-related targets now retain data for a minimum of 14 days. While phishing domains are typically active for less than 24 hours, this update ensures that customers who may not check email daily remain protected from longer or recurring campaigns.

Suspicious and Malicious Domains

The target “TS Originated suspicious and/or malicious domain names – Domains” now retains data for a minimum of 30 days. This change enhances coverage for domains that initially appear inactive but later demonstrate malicious behavior. This domain is not included in policies by default, and must be manually configured if desired.

Compliance and Intelligence Enhancements

OFAC and Sanctioned Entity Detection

Our OFAC and sanctioned entity compliance protections have been significantly upgraded. Detection is now fully automatic and AI-enhanced, improving both speed and precision. The retention window has been extended, and our system dynamically adapts as entities are added or removed from sanction lists. These updates ensure customers remain continuously compliant while benefiting from proactive protection against restricted or high-risk entities.  A separate blog post will be written on this subject soon.

Advanced DNS Tunneling Detection

DNS Tunneling – Domains

We’ve made substantial improvements to our DNS tunneling detection capabilities. This target now retains data for 90 days—three times longer than before—and detection accuracy has improved tenfold. Our updated model identifies VPNs that use DNS for tunneling (commonly browser-based plugins) and detects a new evasion method called CNAME masking, where malicious domains bounce through multiple CNAME records to hide their true destination.

We have observed particularly effective detections of these techniques in live customer environments, where infected hosts attempted to combine CNAME masking and DNS tunneling to evade network protections. Our team was able to help the organization identify and remediate infections before any data exfiltration occurred. Additionally, detection coverage has expanded to include Proton Pro VPN, increasing visibility into VPN-based tunneling behaviors that blend into normal DNS traffic.

Recommendation:

We strongly recommend all customers enable the “DNS Tunneling – Domains” target. It is part of the Command and Control bundle but can also be added individually to your policy. This protection is one of the most effective ways to prevent covert tunneling, command and control communication, and hidden data transfer attempts.

New and Enhanced Detection Capabilities

Funnull Technology Infrastructure Detection

We implemented new detection logic to block all traffic to infrastructure operated by Funnull Technology Inc., which was sanctioned by the U.S. Department of the Treasury and the FBI for facilitating cryptocurrency and romance scam operations.  This has been rolling out since the announcement (linked below).

Our system now automatically identifies and mitigates domains hosted on known Funnull IPs and CNAMEs, ensuring that any malicious or deceptive infrastructure tied to these operations is proactively blocked. (U.S. Treasury Press Release)

Machine Learning–Driven Whitelisting

We introduced an ML-driven system that intelligently separates safe from unsafe traffic. Using reinforcement learning, it continuously refines its understanding of legitimate activity, improving protection accuracy while minimizing false positives.  This is being applied to the ML models we are building to proactively identify malicious traffic for customers.

Spam and Malicious URL Scoring

A new scoring engine now automatically flags URLs with a verdict score above 50, improving visibility into phishing and spam campaigns in real time.  This is a backend feature that a customer wouldn't see anything other than increased detection

Organizational Anomaly Detection

Our new anomaly detection system monitors traffic patterns per organization and automatically alerts the SIR team when traffic significantly exceeds expected thresholds or deviates from baseline activity.  This allows us to identify new infections for customers (and pro-actively notify them), as well as monitor for false positives.  More on this feature in the future as we continue to refine it.

Expanded Intelligence Partnerships

We’ve integrated with new third-party intelligence sources to enhance the speed and scope of detection. These feeds provide earlier visibility into active phishing and malicious-hosting campaigns, enriching the ThreatSTOP ecosystem and improving real-time protection.

Stay Protected

These updates represent ongoing progress in our commitment to delivering proactive, intelligent, and evolving protection across all ThreatSTOP platforms. Our Security, Intelligence, and Research team continues to refine detection coverage to stay ahead of adversaries and improve visibility for our customers.

For those interested in joining the ThreatSTOP family, or to learn more about our proactive protections for all environments, we invite you to visit our product page. Discover how our solutions can make a significant difference in your digital security landscape. We have pricing for all sizes of customers. Get started with a Demo today!

Connect with Customers, Disconnect from Risks

MITRE ATT&CK Framework Mapping

Category

MITRE Technique

Description

Command and Control

T1071.004

DNS Tunneling

Exfiltration

T1048

Exfiltration Over Alternative Protocol

Credential Access

T1556

Input Capture / Phishing

Discovery

T1082

System Information Discovery via Network Data

Evasion

T1568

Dynamic Resolution (CNAME Masking)

Defense Evasion

T1070

Indicator Removal or Obfuscation

Impact

T1486

Data Encryption or Data Manipulation