It isn’t any surprise that most of malware is hosted by American domains and U.S. Internet providers. But according to the recent “Q4 Infoblox DNS Threat Index,” the underlying infrastructure of most malware sits in either the U.S. or Germany even though attackers live elsewhere.

The findings should be taken with a grain of salt since Infoblox’s business is protected Domain Name System (DNS) services. Still, these results are worth a closer look.

A Lesson in Geography

Cybercriminals make use of DNS services for their malicious activities. They can hijack legitimate domains or create batches of new ones that closely resemble real ones (such as googel.com) to collect ransomware, launch phishing and denial-of-service (DOS) attacks and execute other activities such as domain shadowing.

Infoblox collected data from Internet providers, government agencies and network operators to categorize malicious DNS activities. According to this information, the U.S. hosted 72 percent of malware-related domains, while Germany hosted 20 percent.

“Hosting infrastructure in the U.S. is very easy to penetrate and put to malicious use,” the report said. “Just because a domain is hosted in the U.S. or Germany does not make it safe.”

DNS Threats Get More Dangerous

One of the issues identified in the report is that Internet providers are slow to respond to takedown requests from law enforcement.

In the past, the company saw a boom/bust cycle in its DNS threat index. Its theory was that criminals used the quieter times to collect information and prepare new attacks. However, the index kept increasing to reach near-record levels in the last quarter of 2015.

“This may indicate a new phase of sustained and simultaneous plant/harvest efforts, pushing the index into uncharted territory,” the report stated.

Another possible reason for this increase in the threat index is a growing number of exploit kits in use, such as Angler and the rise of an older kit called RIG that has gotten more popular lately. These kits make it easier to target new victims and implement new techniques to spread malware from attackers who are less skilled.

“This indicates that as exploit kits are updated, we may see the reappearance of past threats in a new guise in coming years,” Infoblox warned. “Exploit kits and other malware can be developed in one country, sold in another and used in a third to launch attacks through systems hosted in a fourth.”

A Simple Takeaway

The moral of the report? Understand what these exploits can do. Security leaders must make sure their domains and DNS servers are properly protected and monitored for abuse. It’s also a good idea to invest in threat protection solutions that can identify advanced threats before they become a massive problem.