H1 2026 DNS Report: The DGA Malware Indicator

H1 2026: A Threat Landscape Reshaped by Malware

H1 2026 marked a clear shift in the DNS threat landscape. Overall threat signals increased, malware became the leading threat category, and DNS infrastructure changes were visible before malware activity rose. The report highlights the DGA malware indicator as an early warning signal, with DGA momentum strengthening before the malware surge.

Based on more than 150 billion DNS transactions analyzed every day, the H1 2026 DNS Threat Intelligence Report examines how malware, newly observed domains, DGA activity and phishing evolved during the first half of the year.

Malware Moved to the Top of the Threat Landscape

Malware nearly doubled from H2 2025 to H1 2026, reaching 3.84 billion hits and moving from fourth to first place. Daily malware activity also rose from a January low of 8.0 million hits to an April peak of 32.6 million, roughly quadrupling before remaining elevated through June.

The DGA Malware Indicator Appeared Earlier

The malware surge was not the first signal visible in the DNS data. DGA momentum strengthened in February, providing the earliest indication that new infrastructure was coming online before malicious activity accelerated sharply through March and April. Newly observed domains then increased alongside malicious activity, providing another view into how the surge developed.

Discover Inside the Report

• How malware became the leading threat category, nearly doubling and moving from No. 4 to No. 1.
• Why the DGA malware indicator matters, with DGA activity strengthening before the strongest rise in malicious activity.
• How newly observed domains provide additional context, accelerating alongside the rise in malicious activity.
• What five DGA families reveal about persistence, reactivation, domain registration patterns and continued queries to expired domains.
• How phishing priorities shifted, with overall phishing declining while Logistics & Couriers rose 3.4× in share and moved from No. 7 to No. 3.

The findings show that no single DNS signal tells the whole story. Looking across malware, DGA activity, newly observed domains, phishing and infrastructure changes provides a broader view of how threats develop and where earlier warning signals may emerge.