Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Top DNS domains seen on the Quad9 recursive resolver array each day

github.com

Post reply on HN
Print view View original

21–30 of 100 posts

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#21

Post by danudey »

miyuru wrote: post #16
0points wrote: post #4

> https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t... {"position": 5, "domain_name": "kxulsrwcq.com", "date": "2025-07-10"} What the https://www.ipaddress.com/website/kxulsrwcq.com/ > Safety/Trust: Unknown

google the domains and you will find subdomains that point to cachefly. hiwd.kxulsrwcq.com is pointing to vdd.cachefly.net I am not sure, but my guess is they might be used by some kind of a streaming service.

Most likely something like an ad service to prevent their content being caught by domain blocklists. That would be similar to how a lot of websites started using randomized strings for attributes like id and class so that users couldn't block page elements based on CSS selectors.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#22

Post by ratorx »

jeffbee wrote: post #18

I don't see how it would be possible to produce this table under Quad9's privacy policy. Nothing in their privacy policy says that they maintain logs that would enable them to count queries by label. Can anyone explain?

It does say that they collect this information in their “Data and Privacy Policy”. Specifically section 2.2 (Data Collected): https://quad9.net/privacy/policy/

Which policy are you referring to that implies they don’t?

Also I think you are assuming they store query logs and then aggregate this data later. It is much simpler just to maintain an integer counter for monitoring as the queries come in, and ingest that into a time series database (not sure if that’s what they actually do). Maybe it needs to be a bit fancier to handle the cardinality of DNS names dimension, but re-constructing this from logs would be much more expensive.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#23

Post by danudey »

mammuth wrote: post #17
cbsks wrote: post #2

What’s up with wvdbozpfc.com? There’s a bunch of random looking domain names: cmidphnvq.com, rpqihexdb.com, facebook.com. I’d guess they for advertising?

Are there host lists for pihole/adguard/ublock for these kinds of domains? I'd assume the domains change regularly if it's malware or bot networks, but because they rank so high in this list, it sounds like it should be feasible to keep a blocklist somewhat up to date.

It could also be ad networks; create random domains and subdomains so that simple domain blocklists are difficult to keep up to date efficiently (or at least, so that constant maintenance is required).

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#25

Post by threeducks »

Matheus28 wrote: post #10
0points wrote: post #4

> https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t... {"position": 5, "domain_name": "kxulsrwcq.com", "date": "2025-07-10"} What the https://www.ipaddress.com/website/kxulsrwcq.com/ > Safety/Trust: Unknown

Probably some sort of command and control for a botnet. They calculate a random domain name based on the timestamp (so it’s constantly changing every X days in case it gets seized), and have some validation to make sure commands are signed (to prevent someone name squatting to control their botnet).

Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can.

Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#26

Post by jeffbee »

ratorx wrote: post #22
jeffbee wrote: post #18

I don't see how it would be possible to produce this table under Quad9's privacy policy. Nothing in their privacy policy says that they maintain logs that would enable them to count queries by label. Can anyone explain?

It does say that they collect this information in their “Data and Privacy Policy”. Specifically section 2.2 (Data Collected): https://quad9.net/privacy/policy/ Which policy are you referring to that implies they don’t? Also I think you are assuming they store query logs and then aggregate this data later. It is much simpler just to maintain an integer counter for monitoring as the queries come in, and ingest that int…

I don't see how that is compatible with 2.2. They don't say anything about counters per label. It says counter per RR type, and watermarks of least and most recent timestamps by label, not count by label.

If an organization is going to be this specific about what they count, it implies that this is everything they count, not that there may also be other junk unmentioned.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#27

Post by gchamonlive »

danudey wrote: post #21
miyuru wrote: post #16

Earlier quoted context omitted.

google the domains and you will find subdomains that point to cachefly. hiwd.kxulsrwcq.com is pointing to vdd.cachefly.net I am not sure, but my guess is they might be used by some kind of a streaming service.

Most likely something like an ad service to prevent their content being caught by domain blocklists. That would be similar to how a lot of websites started using randomized strings for attributes like id and class so that users couldn't block page elements based on CSS selectors.

Interesting how ad services and botnets behave similarly in some aspects

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#28

Post by yawndex »

ratorx wrote: post #22
jeffbee wrote: post #18

I don't see how it would be possible to produce this table under Quad9's privacy policy. Nothing in their privacy policy says that they maintain logs that would enable them to count queries by label. Can anyone explain?

It does say that they collect this information in their “Data and Privacy Policy”. Specifically section 2.2 (Data Collected): https://quad9.net/privacy/policy/ Which policy are you referring to that implies they don’t? Also I think you are assuming they store query logs and then aggregate this data later. It is much simpler just to maintain an integer counter for monitoring as the queries come in, and ingest that int…

The section you mentioned does not say anything about having counters for labels. It only mentions that they record "[t]he times of the first and most recent instances of queries for each query label".

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#29

Post by afandian »

threeducks wrote: post #25
Matheus28 wrote: post #10

Earlier quoted context omitted.

Probably some sort of command and control for a botnet. They calculate a random domain name based on the timestamp (so it’s constantly changing every X days in case it gets seized), and have some validation to make sure commands are signed (to prevent someone name squatting to control their botnet).

Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.

I can see a future where Cloudflare or similar offer a DNS + proxy + Root CA combo to intercept these. Maybe they already do.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#30

Post by staplers »

danudey wrote: post #20
jeffbee wrote: post #18

I don't see how it would be possible to produce this table under Quad9's privacy policy. Nothing in their privacy policy says that they maintain logs that would enable them to count queries by label. Can anyone explain?

I took a look at their privacy policy and agree that it doesn't specifically list that it logs which domains are being queried. It does list a bunch of things it does log as counters, all of which seems reasonable, but they don't explicitly say "we count which domains are being queried". That said, I think it's entirely reasonable for them to log domains alone if they're completely disconnected from any user activity…

Unless say, an adversary can link an obscure domain to a specific user/use case. Get that counter log and you can track a certain behavior (only pings this domain when about to do something or when on vacation, their house is empty, etc.)
Post reply on HN