Top DNS domains seen on the Quad9 recursive resolver array each day

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by cbsks on Friday July 11, 2025 @11:42AM (#44533456)

What’s up with wvdbozpfc.com?

There’s a bunch of random looking domain names: cmidphnvq.com, rpqihexdb.com, facebook.com. I’d guess they for advertising?

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by mammuth on Friday July 11, 2025 @11:56AM (#44533677)

Are there host lists for pihole/adguard/ublock for these kinds of domains?

I'd assume the domains change regularly if it's malware or bot networks, but because they rank so high in this list, it sounds like it should be feasible to keep a blocklist somewhat up to date.

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by danudey on Friday July 11, 2025 @12:12PM (#44533892)

It could also be ad networks; create random domains and subdomains so that simple domain blocklists are difficult to keep up to date efficiently (or at least, so that constant maintenance is required).

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by homebrewer on Friday July 11, 2025 @12:39PM (#44534229)

https://gitlab.com/malware-filter

Some of these lists are already in uBO out of the box.

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by t0mas88 on Friday July 11, 2025 @11:46AM (#44533508)

Or malware, those would typically be fairly random domain names that are queried for updates or instructions by a large number of infected devices.

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by 0points on Friday July 11, 2025 @11:49AM (#44533556)

That's what I'm thinking too. That would suggest some very large operational botnets ... :-/

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by netsharc on Friday July 11, 2025 @12:02PM (#44533758)

Or they query the DNS very often. Most devices have DNS caching, so if things like tiktok.com end up there, there must be a loot of devices (also, a lot of subdomains, which aren't visible in these lists).

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by gmuslera on Friday July 11, 2025 @11:54AM (#44533635)

It could be a good pattern for spam/ads organizations, changing the random domain name as soon as traffic drops because the actual ones ended in enough blocklists.

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by BearOso on Friday July 11, 2025 @11:48AM (#44533542)

I looked up a couple. They're cloudflare regional servers.

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by forty on Friday July 11, 2025 @11:46AM (#44533506)

Also blockdh100b ?

[ Parent | on HN ]

Re:Top DNS domains seen on the Quad9 recursive resolver arra... by maxmcd on Friday July 11, 2025 @12:42PM (#44534255)

router.blockdh100b.net resolves

so does router.blockdh100c.co

[ Parent | on HN ]