> https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t... {"position": 5, "domain_name": "kxulsrwcq.com", "date": "2025-07-10"} What the https://www.ipaddress.com/website/kxulsrwcq.com/ > Safety/Trust: Unknown
Poor Argentina…
Top DNS domains seen on the Quad9 recursive resolver array each day
61–70 of 100 posts
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#62> https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t... {"position": 5, "domain_name": "kxulsrwcq.com", "date": "2025-07-10"} What the https://www.ipaddress.com/website/kxulsrwcq.com/ > Safety/Trust: Unknown
One of the CNAME's defined for that domain is "hiwd.kxulsrwcq.com" which appears to be flagged for malware. https://www.securefeed.com/Content/WebLookup?host=hiwd.kxuls...
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#63Seems like it'd be a good addition to the Tranco list: https://tranco-list.eu/
Came here to say: if people are interested in this stuff, they should just pull down the Tranco list --- it includes feeds from Quad9 and Cloudflare.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#64Earlier quoted context omitted.
Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.
there are tools pretty good at detecting DGAs these days, but not often implemented. the best thing to do afaik is use services normal user shave access to, and communicate via those. its hard to tell for anyone who's extracting the data from the third party so the server is hidden. (e.g bot posts images to twitter, and server scrapes the images from twitter, this is also already old news but easier and more likely t…
It's one of many possible strategies. Any one strategy can be blocked if it's used by enough malicious actors (e.g. Twitter can be forced to block base64 tweets); if they all use different strategies, it becomes harder to justify blocking each individual one.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#65Earlier quoted context omitted.
Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.
> Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. There is a fairly simple method which achieves the same advantage for a botnet controller. 1. Use a hash of the current day to derive, for that day, an infinite stream of domain names. This…
I've definitely heard of cnc using a plural of domains for this reason. the bots have a list of domains they reach out to, searching for one that is valid.
I believe one issue with this strategy is many corporate VPNs block fresh domains. I guess if the software was pinned to use encrypted DNS instead of whatever the OS recommends, then the DNS blocking could be avoided...
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#66Earlier quoted context omitted.
Most likely something like an ad service to prevent their content being caught by domain blocklists. That would be similar to how a lot of websites started using randomized strings for attributes like id and class so that users couldn't block page elements based on CSS selectors.
Interesting how ad services and botnets behave similarly in some aspects
They are both malicious software that lots of people want to block; one happens to be legal.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#67transmissionbt.com (A bittorrent client for macOS) is out ranking youtube, wikipedia, github, etc. Is transmission that popular? I assume its the auto-updater? Seems insane. https://github.com/Quad9DNS/quad9-domains-top500/blob/dfd513...
My guess is that DNS caching in web browsers prevents repeated lookup requests where as maybe the transmission implementation has no caching and does a lookup every time.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#68example.com #17 ?
Vibe coders.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#69Earlier quoted context omitted.
> Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can. There is a fairly simple method which achieves the same advantage for a botnet controller. 1. Use a hash of the current day to derive, for that day, an infinite stream of domain names. This…
Here's the same image on a less horrible file hosting: https://files.catbox.moe/gilmd1.png Imgur has been inaccessible for me for months, they're one of those organizations that consider it proper to block whole countries to counter bot abuse.
Hmm, catbox used to be blocked for me too, but I can access it today. That's interesting.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#70transmissionbt.com (A bittorrent client for macOS) is out ranking youtube, wikipedia, github, etc. Is transmission that popular? I assume its the auto-updater? Seems insane. https://github.com/Quad9DNS/quad9-domains-top500/blob/dfd513...
Its available for Linux and Windows as well.
So are YouTube, Wikipedia and GitHub.