A domain with no address record gives blocklist tooling nothing to work with: passive DNS has no resolution to sample, and reputation scoring has no history to score. Whisper Security reports that a large pool of the group's domains sits in exactly that state, registered, with nameserver records pointing at machines the operators run themselves, and no A record anywhere [13]. Those nameserver-only boxes answer no malware and host no command service [12]. Activation is one record added on hardware the operators already control. No registrar contact, no new hosting order, no WHOIS event for anyone to notice.
The aging rate is measurable. SafeBreach published its second report on the actor in February 2026 [5]. By 13 August 2026, Whisper's expansion of those indicators through an infrastructure graph placed the group's servers across several blocks of a small Romanian reseller, AS204641 (HOSTGW), rather than the single range the reports named [1][8]. One of them, 185.244.129.70, carries the group's DGA domains, appears in neither SafeBreach report, and is listed in no threat-intelligence feed Whisper checked [9]. Roughly six months between publication and a documented gap in the published set [16].
The wiring explains why takedown leverage is thin. On the live servers, the domain, the address it resolves to, and the nameserver that answers the lookup are the same box: dmxqdlcuiryu.site resolves to 45.80.148.195, and ns1.dmxqdlcuiryu.site sits on 45.80.148.195; the .space domains on 45.80.149.3 are arranged the same way [11]. There is no third-party DNS provider in the path to send a complaint to.
Two limits on the finding. Whisper calls the inactive pool large but publishes no count, and gives no registration or activation dates [17], so the claim that the reserve expires blocklists on the operators' timing is structural rather than scheduled. And Whisper is explicit that "live" here means DNS-active, not confirmation that a server answers victims, which requires a direct connection it did not make [10].
The counterweight is that the enumeration is repeatable. Whisper identified the prepared domains using naming rules SafeBreach had already documented [14], which means a defender willing to run the rules does not have to wait for a vendor feed to catch up. That matters for who is being hit. Unit 42's 2016 write-up traced the campaign back to around 2007 against Iranian dissidents, journalists and opposition figures, with some government and telecommunications targets [3] - about nineteen years of continuous operation [15] against a population that mostly does not run a SOC. The current pairing, Foudre and Tonnerre, keeps a cheap first-stage profiler broad and reserves the second stage for targets the operators judge worth it [4].
