You Are the Camouflage: How Cheap Domains and Free Infrastructure Subsidize Cybercrime

Quick note to my regular readers: You might notice that this article’s tone isn’t as scholarly as some of my other ones. That’s why I’ve categorized it under Rants. This is something that has been on my mind for a long time and the only way to explain it is by doing some light ranting about it.

Here in America, there's a growing cognizance of the toll our throwaway culture is taking on our bodies, our economy, and the environment. Our insatiable need for the items we want as quickly and as cheaply as possible—fueled in part by the skyrocketing cost of living—makes it difficult to get back on the right track, where we can prioritize higher quality items that are not as detrimental to literally everything.

It should come as no shock to you that elements of the domain name system, and the services that rely upon it, have partaken in this exact same race to the bottom. When we have an idea for a small project or a "could-be" business, we seek out the cheapest domain, the free hosting, and anything else we can get our hands on so that this idea can live online without costing a small fortune.

But much like fast fashion and single-use plastics have macro consequences, so does our cheapness when it comes to the internet. We need to talk about the consequences of our collective refusal to spend a few dollars on digital plumbing. You aren't just being frugal. You're contributing to a much bigger, much uglier problem that cybercriminals need you to contribute to.

Meet the "Exploitable Service"

During my time at CleanDNS, we coined a term internally for the platforms enabling this behavior: exploitable services.

An exploitable service is any platform that offers free, easily automated resources (like subdomains, DDNS, or hosting) where legitimate users and cybercriminals are mixed so tightly together that you cannot block the bad guys without taking the good guys offline too. By design, these services force third-party security teams—or the internet at large—to clean up the abuse because the provider won't, or can't, do it themselves.

When you use an exploitable service, you become part of the shield. Let's look at how this plays out across the ecosystem.

The $0.99 Domain and the "Noise Floor" Economy

In signal processing, the "noise floor" is the baseline level of background static in a system. If a specific signal isn't louder than the noise floor, it gets completely masked and cannot be detected.

In the domain industry, the "signal" that security researchers are looking for is the concentration of malicious activity. If a registrar's portfolio is 100% cybercrime, the signal is deafening. They get blacklisted by the security industry, their payment processors freeze their accounts, and ICANN Compliance eventually pulls their accreditation.

To survive, high-abuse registrars need to artificially raise their noise floor to mask the illicit signal.

There is a reason certain registrars constantly run promotions offering domains for less than a dollar. It is a volume game. When all the "good" domain names are taken, it is fair to wonder why anyone buys obscure domain names in massive bulk.

Cybercriminals do. Phishers, botnet operators, and malware developers need hundreds or even thousands of domains for a single campaign. Because cybercrime is a numbers game, the overwhelming majority of these domains are neutralized quickly by blocklists. But it only takes a few victims falling through the cracks to make the entire operation profitable.

However, to keep selling to those criminals, the registrar needs legitimate traffic to drown them out.

When you buy that cheap domain to host your resume or your family blog, your legitimate purchase gets mixed into their portfolio. You become the background static. When auditors or researchers look at the registrar, the malicious activity is hidden beneath a massive volume of everyday internet traffic. The operator points to your domain and says, "See? We have real, legitimate customers!"

You provide their statistical alibi.

The financial reality is always a bait-and-switch anyway. That $0.99 domain jumps to $40 upon renewal. You refuse to pay it and let the domain expire. The registrar immediately parks it or, worse, a bad actor snaps it up to leverage the domain's one-year "aged" status to bypass security filters. You saved $11 on registration, but you provided the exact camouflage a business model designed to arm scammers needed to survive.

The Toxic Wasteland of Free DDNS

Let’s talk about free Dynamic DNS (DDNS) providers. Services like a certain mallard named one are incredibly popular for hobbyists wanting to expose their local Home Assistant instance or Plex server to the internet. They do this because they cannot get a static IP address, nor do they wish to spend the money on a real domain and write the script to update their home IP.

Here is the problem: when a service has zero friction to entry and zero financial cost, it is immediately co-opted. Free DDNS is the backbone of modern Command and Control (C2) infrastructure. It allows a bad guy to route infected machines back to an IP that they can change at will, completely free of charge.

This results in digital redlining. When you build your legitimate house in a neighborhood entirely populated by cartels, you shouldn't be surprised when the collateral damage hits your front door. If your personal VPN suddenly stops resolving from your corporate network, it is probably because the enterprise firewall automatically dropped the traffic. They didn't target you; they targeted the toxic neighborhood you chose to live in.

Furthermore, in economics, there is no such thing as a free lunch. Someone is paying for the servers, the bandwidth, and the domains. Maybe the provider started pure, running the service out of the goodness of their heart. But as the project grows, bills become unmanageable. That's when data companies step in and make an offer: we will foot the bill if you let us see all the traffic and send the bad stuff to our threat intel feeds.

So, you get a free hostname to access your home server, and in exchange, a massive cybersecurity company is sinkholing and watching that traffic. And I assure you, this is a very real thing happening right now with very large free DDNS providers.

Compliance Theater: Free Inbound-Only Email

The abuse of free infrastructure extends to how bad actors navigate the few rules that actually exist.

To maintain their accreditation, registrars are required by ICANN to verify the contact information of their registrants—usually by sending an email with a verification link. To pass this check without spending money or leaving a traceable footprint, threat actors utilize free, inbound-only email services.

These services are the ultimate form of compliance theater. The bad guy signs up, receives the verification email, clicks the link, and proves they "own" the address. The registrar gets to check the compliance box. But because the service is inbound-only, investigators cannot trace outbound infrastructure, serve a subpoena, or communicate back. It is a one-way mirror for scammers that completely neuters the intent of ICANN policy and makes enforcement nearly impossible.

And remember: the operators of these free mail servers likely have poorly defined terms of service (if they exist at all). They own the server, which means they are free to do whatever they want with the data flowing into it.

The Free Hosting Epidemic

It isn't just domains and DDNS. Look at the explosion of phishing pages hosted on the free tiers of platforms like Vercel, Firebase, GitHub Pages, Cloudflare's pages.dev, Wix, and legacy abusers like 000webhost.

Threat actors spin up thousands of malicious subdomains on these highly trusted domains. Because the root domains (vercel.app, wixsite.com) belong to massive, legitimate tech companies, security vendors are terrified to block them outright. Sinkholing the entirety of `pages.dev` would break tons of legitimate internet.

The threat actor knows this. When they abuse these exploitable services, they get enterprise-grade CDN routing, free SSL certificates, and default trust—all for zero dollars.

And once again, they need you to make this work. When you host your legitimate wedding RSVP site on a free .wixsite.com subdomain, or push a weekend project to pages.dev, you are adding to the “too big to fail” credibility of that root domain. The provider gets to claim massive user growth, you get a free site, and the bad guy gets an unblockable phishing host. The only losers are the victims.

Stop Buying and Using Digital Fast Fashion

We need to stop pretending that our tech habits exist in a vacuum. The internet is broken in large part because we refuse to pay for the plumbing.

The next time you are tempted to use a bottom-tier registrar to save the cost of a cup of coffee, or you decide to route your personal infrastructure through a free service notorious for malware hosting, remember what you are fueling. You are either financially subsidizing a broken model or providing the statistical camouflage it needs to survive.

Pay the $15 for a real domain. Pay the few bucks a month for reliable, accountable infrastructure. Learn how to set up the service yourself with some equipment you have lying around. Go the extra mile. In the age of AI, it is easier than ever to learn how to stand up exactly what you need without resorting to exploitable services.

Good digital citizenship starts with not being the camouflage.