What is amazon.dev? Does not resolve for me.
{"position": 127, "domain_name": "amazon.dev", "date": "2025-07-10"}
Source: https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t...
Top DNS domains seen on the Quad9 recursive resolver array each day
41–50 of 100 posts
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#42The Cloudflare Radar page is probably a more representative sample: https://radar.cloudflare.com/domains
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#43transmissionbt.com (A bittorrent client for macOS) is out ranking youtube, wikipedia, github, etc. Is transmission that popular? I assume its the auto-updater? Seems insane. https://github.com/Quad9DNS/quad9-domains-top500/blob/dfd513...
It's likely the port open check that's built-in: https://portcheck.transmissionbt.com/443
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#44What is amazon.dev? Does not resolve for me. {"position": 127, "domain_name": "amazon.dev", "date": "2025-07-10"} Source: https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t...
https://www.google.com/search?q=%22amazon.dev%22
Looks like their customer support rep portal. Presumably there are not A/CNAME records at the top level, but na.headphones.whs.amazon.dev resolves.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#45example.com #17 ?
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#46Earlier quoted context omitted.
Probably some sort of command and control for a botnet. They calculate a random domain name based on the timestamp (so it’s constantly changing every X days in case it gets seized), and have some validation to make sure commands are signed (to prevent someone name squatting to control their botnet).
Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.
> Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can.
There is a fairly simple method which achieves the same advantage for a botnet controller.
1. Use a hash of the current day to derive, for that day, an infinite stream of domain names. This could be something as simple as `to_human_readable_domain(sha256(daily_hash + i))`.
2. A botnet slave attempts to access servers in a diagonal order over (days, domains), starting at the first domain for today and working backwards in days and forwards in domains. An image best describes what I mean by this: https://i.imgur.com/lcEbHwz.png
3. So long as one of those domains is controlled by the botnet operator (which can be verified using a signed response from the server), they can control the botnet.
This means that the botnet operator only needs to purchase one domain every couple of days to keep controlling their botnet, while someone trying to stop them will have to buy thousands and thousands every day.
And when you successfully purchase a domain you can publish the new domain to any connected slaves, so this scheme is only necessary for recruitment into the network, not continued control.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#47Earlier quoted context omitted.
Unless say, an adversary can link an obscure domain to a specific user/use case. Get that counter log and you can track a certain behavior (only pings this domain when about to do something or when on vacation, their house is empty, etc.)
The average burglar probably isn’t cross-referencing DNS statistics.
Yes but I don't think the average Quad9 user is worried about being tracked by average burglars.. more like advanced syndicates and nation states.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#48Earlier quoted context omitted.
I took a look at their privacy policy and agree that it doesn't specifically list that it logs which domains are being queried. It does list a bunch of things it does log as counters, all of which seems reasonable, but they don't explicitly say "we count which domains are being queried". That said, I think it's entirely reasonable for them to log domains alone if they're completely disconnected from any user activity…
Unless say, an adversary can link an obscure domain to a specific user/use case. Get that counter log and you can track a certain behavior (only pings this domain when about to do something or when on vacation, their house is empty, etc.)
One way around that is to set up a cron job that queries the most common domains one visits hourly. When requested by workstations and cell phones they will be served up by cache. At least that is what I have been doing for a few decades and works fine. I block all the DoH/DoT resolvers which is easier to do than some might think. One can do the individual A records or just the apex A/NS records to get infrastructure cache and then configure Unbound to prefetch records about to expire.
Just for fun I have added some of these into my cron job.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#49example.com #17 ?
Funny, people don't bother reading RFCs
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#50It's quite interesting to me that ChatGPT is in the 200s and 300s.
By almost every metric this is one of the 10 busiest websites, and some sources are already putting it in the top 5.
Are they just disproportionately not using Quad9?
I understand that there's a lot of overlap with Google having several spots in the top 50 itself, several being infrastructure like cloudflare and akamai, and several others being malware - but it still seems surprising.
It's just kind of shocking to see Slack, Zoom, LinkedIn, and even DropBox, Roku, and Yandex much higher up.