A method and apparatus that provide a malicious domain emulator in a distributed cloud computing network are described. A malicious node emulator is executed as a third-party code in a compute server of the cloud computing platform to enable emulation of behavior of a malicious node. The malicious node emulator receives requests from one or multiple network devices addressed to the malicious domain and automatically emulates the behavior of the malicious domain to respond to these requests. The malicious node emulator logs information related to the requests and the network devices transmitting the requests.