Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Top DNS domains seen on the Quad9 recursive resolver array each day

github.com

Post reply on HN
Print view View original

11–20 of 100 posts

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#11

Post by 0points »

t0mas88 wrote: post #6
cbsks wrote: post #2

What’s up with wvdbozpfc.com? There’s a bunch of random looking domain names: cmidphnvq.com, rpqihexdb.com, facebook.com. I’d guess they for advertising?

Or malware, those would typically be fairly random domain names that are queried for updates or instructions by a large number of infected devices.

That's what I'm thinking too. That would suggest some very large operational botnets ... :-/

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#12

Post by netsharc »

0points wrote: post #8
0points wrote: post #4

> https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t... {"position": 5, "domain_name": "kxulsrwcq.com", "date": "2025-07-10"} What the https://www.ipaddress.com/website/kxulsrwcq.com/ > Safety/Trust: Unknown

More: {"position": 26, "domain_name": "cmidphnvq.com", "date": "2025-07-10"} {"position": 28, "domain_name": "xmqkychtb.com", "date": "2025-07-10"} {"position": 37, "domain_name": "ezdrtpvsa.com", "date": "2025-07-10"} {"position": 38, "domain_name": "wvdbozpfc.com", "date": "2025-07-10"} {"position": 46, "domain_name": "bldrdoc.gov", "date": "2025-07-10"} {"position": 52, "domain_name": "gadf99632rm.xyz", "date": "2…

bldrdoc.gov seems to be Cisco devices looking for a time server: https://community.cisco.com/t5/ipv6/cisco-switch-generating-...

Geniuses...

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#14

Post by gmuslera »

cbsks wrote: post #2

What’s up with wvdbozpfc.com? There’s a bunch of random looking domain names: cmidphnvq.com, rpqihexdb.com, facebook.com. I’d guess they for advertising?

It could be a good pattern for spam/ads organizations, changing the random domain name as soon as traffic drops because the actual ones ended in enough blocklists.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#15

Post by 0points »

netsharc wrote: post #12
0points wrote: post #8

Earlier quoted context omitted.

More: {"position": 26, "domain_name": "cmidphnvq.com", "date": "2025-07-10"} {"position": 28, "domain_name": "xmqkychtb.com", "date": "2025-07-10"} {"position": 37, "domain_name": "ezdrtpvsa.com", "date": "2025-07-10"} {"position": 38, "domain_name": "wvdbozpfc.com", "date": "2025-07-10"} {"position": 46, "domain_name": "bldrdoc.gov", "date": "2025-07-10"} {"position": 52, "domain_name": "gadf99632rm.xyz", "date": "2…

bldrdoc.gov seems to be Cisco devices looking for a time server: https://community.cisco.com/t5/ipv6/cisco-switch-generating-... Geniuses...

Oh, hah. Well that doesn't seem intentionally malicious then.

I added it in the first place as it was a non-resolving .gov in the top 50 list which seemed out of place to me.

> bldrdoc.gov: No address associated with hostname

I see that the time related subdomains in your link do resolve to the nist.gov timeserver.

But I really am wondering what's up with all of the rest of these domains.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#16

Post by miyuru »

0points wrote: post #4

> https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t... {"position": 5, "domain_name": "kxulsrwcq.com", "date": "2025-07-10"} What the https://www.ipaddress.com/website/kxulsrwcq.com/ > Safety/Trust: Unknown

google the domains and you will find subdomains that point to cachefly.

    hiwd.kxulsrwcq.com is pointing to vdd.cachefly.net
I am not sure, but my guess is they might be used by some kind of a streaming service.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#17

Post by mammuth »

cbsks wrote: post #2

What’s up with wvdbozpfc.com? There’s a bunch of random looking domain names: cmidphnvq.com, rpqihexdb.com, facebook.com. I’d guess they for advertising?

Are there host lists for pihole/adguard/ublock for these kinds of domains?

I'd assume the domains change regularly if it's malware or bot networks, but because they rank so high in this list, it sounds like it should be feasible to keep a blocklist somewhat up to date.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#19

Post by netsharc »

0points wrote: post #11
t0mas88 wrote: post #6

Earlier quoted context omitted.

Or malware, those would typically be fairly random domain names that are queried for updates or instructions by a large number of infected devices.

That's what I'm thinking too. That would suggest some very large operational botnets ... :-/

Or they query the DNS very often. Most devices have DNS caching, so if things like tiktok.com end up there, there must be a loot of devices (also, a lot of subdomains, which aren't visible in these lists).

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#20

Post by danudey »

jeffbee wrote: post #18

I don't see how it would be possible to produce this table under Quad9's privacy policy. Nothing in their privacy policy says that they maintain logs that would enable them to count queries by label. Can anyone explain?

I took a look at their privacy policy and agree that it doesn't specifically list that it logs which domains are being queried. It does list a bunch of things it does log as counters, all of which seems reasonable, but they don't explicitly say "we count which domains are being queried".

That said, I think it's entirely reasonable for them to log domains alone if they're completely disconnected from any user activity, i.e. a simple "increment the counter for foo.com" is reasonable since that's unrelated to user privacy.

Post reply on HN