Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Top DNS domains seen on the Quad9 recursive resolver array each day

github.com

Post reply on HN
Print view View original

31–40 of 100 posts

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#31

Post by [deleted] »

threeducks wrote: post #25
Matheus28 wrote: post #10

Earlier quoted context omitted.

Probably some sort of command and control for a botnet. They calculate a random domain name based on the timestamp (so it’s constantly changing every X days in case it gets seized), and have some validation to make sure commands are signed (to prevent someone name squatting to control their botnet).

Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.

[deleted]

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#32

Post by homebrewer »

mammuth wrote: post #17
cbsks wrote: post #2

What’s up with wvdbozpfc.com? There’s a bunch of random looking domain names: cmidphnvq.com, rpqihexdb.com, facebook.com. I’d guess they for advertising?

Are there host lists for pihole/adguard/ublock for these kinds of domains? I'd assume the domains change regularly if it's malware or bot networks, but because they rank so high in this list, it sounds like it should be feasible to keep a blocklist somewhat up to date.

https://gitlab.com/malware-filter

Some of these lists are already in uBO out of the box.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#34

Post by threeducks »

afandian wrote: post #29
threeducks wrote: post #25

Earlier quoted context omitted.

Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.

I can see a future where Cloudflare or similar offer a DNS + proxy + Root CA combo to intercept these. Maybe they already do.

That might work for the current generation of bots, but it will become infeasible when the domain names are generated in such a way that they overlap with spellable and existing domain names.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#35

Post by maxmcd »

forty wrote: post #5
cbsks wrote: post #2

What’s up with wvdbozpfc.com? There’s a bunch of random looking domain names: cmidphnvq.com, rpqihexdb.com, facebook.com. I’d guess they for advertising?

Also blockdh100b ?

router.blockdh100b.net resolves

so does router.blockdh100c.co

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#36

Post by Tijdreiziger »

afandian wrote: post #29
threeducks wrote: post #25

Earlier quoted context omitted.

Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.

I can see a future where Cloudflare or similar offer a DNS + proxy + Root CA combo to intercept these. Maybe they already do.

Quad9 (the subject of this post) already offers ‘threat blocking’ by default.

https://quad9.net/service/threat-blocking/

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#38

Post by umpalumpaaa »

GCUMstlyHarmls wrote: post #33

transmissionbt.com (A bittorrent client for macOS) is out ranking youtube, wikipedia, github, etc. Is transmission that popular? I assume its the auto-updater? Seems insane. https://github.com/Quad9DNS/quad9-domains-top500/blob/dfd513...

Its available for Linux and Windows as well.

Re: Top DNS domains seen on the Quad9 recursive resolver array each day

#40

Post by Tijdreiziger »

staplers wrote: post #30
danudey wrote: post #20

Earlier quoted context omitted.

I took a look at their privacy policy and agree that it doesn't specifically list that it logs which domains are being queried. It does list a bunch of things it does log as counters, all of which seems reasonable, but they don't explicitly say "we count which domains are being queried". That said, I think it's entirely reasonable for them to log domains alone if they're completely disconnected from any user activity…

Unless say, an adversary can link an obscure domain to a specific user/use case. Get that counter log and you can track a certain behavior (only pings this domain when about to do something or when on vacation, their house is empty, etc.)

The average burglar probably isn’t cross-referencing DNS statistics.
Post reply on HN