Earlier quoted context omitted.
Its available for Linux and Windows as well.
So are YouTube, Wikipedia and GitHub.
I was responding to "A bittorrent client for macOS" - I wanted to make it clear that the client is not only available on macOS.
Top DNS domains seen on the Quad9 recursive resolver array each day
91–100 of 100 posts
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#92Earlier quoted context omitted.
bldrdoc.gov seems to be Cisco devices looking for a time server: https://community.cisco.com/t5/ipv6/cisco-switch-generating-... Geniuses...
Oh, hah. Well that doesn't seem intentionally malicious then. I added it in the first place as it was a non-resolving .gov in the top 50 list which seemed out of place to me. > bldrdoc.gov: No address associated with hostname I see that the time related subdomains in your link do resolve to the nist.gov timeserver. But I really am wondering what's up with all of the rest of these domains.
Googling it, one of the results was https://library.bldrdoc.gov/ , for Boulder Labs Library.
More googling gave me https://www.boulder.doc.gov
> Boulder is the home of scientific laboratories for the U. S. Department of Commerce’s NOAA, NIST and NTIA. Clustered on the foothills of the Rocky Mountains in Boulder Colorado, these labs are the home of scientific research and engineering in the fields of electromagnetics, materials reliability, optoelectronics, quantum electronics and physics, time and frequency, earth systems, weather and telecommunications.
Looks like a place full of scientific knowledge. I hope they haven't suffered much DOGEing.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#93transmissionbt.com (A bittorrent client for macOS) is out ranking youtube, wikipedia, github, etc. Is transmission that popular? I assume its the auto-updater? Seems insane. https://github.com/Quad9DNS/quad9-domains-top500/blob/dfd513...
My guess is that DNS caching in web browsers prevents repeated lookup requests where as maybe the transmission implementation has no caching and does a lookup every time.
That makes the most sense.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#94transmissionbt.com (A bittorrent client for macOS) is out ranking youtube, wikipedia, github, etc. Is transmission that popular? I assume its the auto-updater? Seems insane. https://github.com/Quad9DNS/quad9-domains-top500/blob/dfd513...
If people have naïvely configured their BIND client libraries to talk directly to Quad9, instead of via a machine-local forwarding caching proxy DNS server, then libcurl can be sending a re-query out to Quad9 every 60 seconds for domains that it actively needs to map to IP addresses.
* https://curl.se/libcurl/c/CURLOPT_DNS_CACHE_TIMEOUT.html
Excessive DNS traffic and the interaction with libcurl and with not having a machine-local forwarding caching proxy DNS server, is a known and open issue with that software.
* https://github.com/transmission/transmission/issues/1815
Having a machine-local forwarding caching proxy DNS server is in general a good idea. It provides exactly the sort of traffic concentration and redundancy elimination that is required by libcurl's 60 second re-queries, which is otherwise still traffic going out over a gateway even when Quad9 is co-located with one's ISP.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#95Earlier quoted context omitted.
there are tools pretty good at detecting DGAs these days, but not often implemented. the best thing to do afaik is use services normal user shave access to, and communicate via those. its hard to tell for anyone who's extracting the data from the third party so the server is hidden. (e.g bot posts images to twitter, and server scrapes the images from twitter, this is also already old news but easier and more likely t…
It's one of many possible strategies. Any one strategy can be blocked if it's used by enough malicious actors (e.g. Twitter can be forced to block base64 tweets); if they all use different strategies, it becomes harder to justify blocking each individual one.
you either need whitelisting, which ppl dont want because they need to send tweets and sync gdrive on their corpo laptops ;')...
so i guess that leaves u with modeling normal user behavior to spot anomalies without the actual packet data being an indicator.
then the bots could piggyback on regular coms still, but it'd definitely raise the bar...
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#96Earlier quoted context omitted.
I can see a future where Cloudflare or similar offer a DNS + proxy + Root CA combo to intercept these. Maybe they already do.
That might work for the current generation of bots, but it will become infeasible when the domain names are generated in such a way that they overlap with spellable and existing domain names.
> it will become infeasible when the domain names are generated in such a way that they overlap with spellable and existing domain names.
And why do you believe this will even happen?
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#97Who are looking up PTR records? 54.in-addr.arpa looks to be Amazon's range and there are several others.
It's probably a lot of automated tooling/monitoring infrastructure that's doing reverse resolution of IPs to get hostnames. Edit : I've found that sometimes they're pretty poor at caching responses so you end up with a lot of these requests.
Mail servers typically resolve a remote IP to a PTR. High number of PTR requests can indicate that the network is used to send email. Amazon (both SES and EC2) is one of the biggest email sources on the Internet (ranging from ham to marketing and there is huge spam volume from AWS too).
Thought I don’t expect mail servers to use quad9.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#98Earlier quoted context omitted.
It's probably a lot of automated tooling/monitoring infrastructure that's doing reverse resolution of IPs to get hostnames. Edit : I've found that sometimes they're pretty poor at caching responses so you end up with a lot of these requests.
Mail servers typically resolve a remote IP to a PTR. High number of PTR requests can indicate that the network is used to send email. Amazon (both SES and EC2) is one of the biggest email sources on the Internet (ranging from ham to marketing and there is huge spam volume from AWS too). Thought I don’t expect mail servers to use quad9.
Why not?
I have unbound with upstream set to 1.1.1.1 and 9.9.9.9.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#99Earlier quoted context omitted.
Mail servers typically resolve a remote IP to a PTR. High number of PTR requests can indicate that the network is used to send email. Amazon (both SES and EC2) is one of the biggest email sources on the Internet (ranging from ham to marketing and there is huge spam volume from AWS too). Thought I don’t expect mail servers to use quad9.
Why not? I have unbound with upstream set to 1.1.1.1 and 9.9.9.9.
If you run a mail server it's good to have a local DNS cache, e. g. Unbound. And if you have Unbound adding an upstream is not that necessary - it can talk to root servers directly or use hoster's DNS as upstream. I rarely use services like Quad9 but IMHO the main use case is for home PC / notebooks: e. g. if an ISP neglected it's own DNS (and it doesn't work well) or if an ISP spoof NXDOMAIN to return ads; another use case is free Wi-Fi where DNS can also be misconfigured / unreliable.
For an ISP it's relatively easy to provide a DNS server which will be fast and reliable (and your ISP's DNS is close to you than some 3rd party DNS) if that's not the case they probably just don't care.
Re: Top DNS domains seen on the Quad9 recursive resolver array each day
#100The Cloudflare Radar page is probably a more representative sample: https://radar.cloudflare.com/domains
I'm surprised we are not seeing any porn site. What's going on?