Top DNS domains seen on the Quad9 recursive resolver array each day

https://github.com/Quad9DNS/quad9-domains-top500

by speckx • 1 year ago

160 97 1 year ago

cbsks• 1 year ago

What’s up with wvdbozpfc.com?

There’s a bunch of random looking domain names: cmidphnvq.com, rpqihexdb.com, facebook.com. I’d guess they for advertising?

forty• 1 year ago

Also blockdh100b ?

maxmcd• 1 year ago

router.blockdh100b.net resolves

so does router.blockdh100c.co

t0mas88• 1 year ago

Or malware, those would typically be fairly random domain names that are queried for updates or instructions by a large number of infected devices.

0points5• 1 year ago

That's what I'm thinking too. That would suggest some very large operational botnets ... :-/

BearOso• 1 year ago

I looked up a couple. They're cloudflare regional servers.

gmuslera• 1 year ago

It could be a good pattern for spam/ads organizations, changing the random domain name as soon as traffic drops because the actual ones ended in enough blocklists.

mammuth• 1 year ago

Are there host lists for pihole/adguard/ublock for these kinds of domains?

I'd assume the domains change regularly if it's malware or bot networks, but because they rank so high in this list, it sounds like it should be feasible to keep a blocklist somewhat up to date.

danudey3• 1 year ago

It could also be ad networks; create random domains and subdomains so that simple domain blocklists are difficult to keep up to date efficiently (or at least, so that constant maintenance is required).

homebrewer• 1 year ago

https://gitlab.com/malware-filter

Some of these lists are already in uBO out of the box.

jtbayly• 1 year ago

I expected to see porn in the list.

atomicnumber3• 1 year ago

I was personally going to be surprised. Bots and machines categorically do not peruse such material, and DNS traffic is largely not going to have a human on the other end.

0points5• 1 year ago

https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t...

{"position": 5, "domain_name": "kxulsrwcq.com", "date": "2025-07-10"}

What the

https://www.ipaddress.com/website/kxulsrwcq.com/

Safety/Trust: Unknown

0points5• 1 year ago

{"position": 26, "domain_name": "cmidphnvq.com", "date": "2025-07-10"}

{"position": 28, "domain_name": "xmqkychtb.com", "date": "2025-07-10"}

{"position": 37, "domain_name": "ezdrtpvsa.com", "date": "2025-07-10"}

{"position": 38, "domain_name": "wvdbozpfc.com", "date": "2025-07-10"}

{"position": 46, "domain_name": "bldrdoc.gov", "date": "2025-07-10"}

{"position": 52, "domain_name": "gadf99632rm.xyz", "date": "2025-07-10"}

netsharc3• 1 year ago

bldrdoc.gov seems to be Cisco devices looking for a time server: https://community.cisco.com/t5/ipv6/cisco-switch-generating-...

Geniuses...

Matheus28• 1 year ago

Probably some sort of command and control for a botnet.

They calculate a random domain name based on the timestamp (so it’s constantly changing every X days in case it gets seized), and have some validation to make sure commands are signed (to prevent someone name squatting to control their botnet).

threeducks2• 1 year ago

Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can.

Time-lock puzzles come close, but but it requires that the bots have computing power comparable to the security researchers.

miyuru• 1 year ago

google the domains and you will find subdomains that point to cachefly.

    hiwd.kxulsrwcq.com is pointing to vdd.cachefly.net

I am not sure, but my guess is they might be used by some kind of a streaming service.

danudey3• 1 year ago

Most likely something like an ad service to prevent their content being caught by domain blocklists. That would be similar to how a lot of websites started using randomized strings for attributes like id and class so that users couldn't block page elements based on CSS selectors.

danielcid2• 1 year ago

And they are often used with random sub domains as well (but they did not include sub domains in their list).

Ex:

https://dnsarchive.net/search?q=cmidphnvq.com

https://dnsarchive.net/search?q=xmqkychtb

https://dnsarchive.net/ipv4/34.126.227.30

reactordev• 1 year ago

Poor Argentina…

https://radar.cloudflare.com/domains/domain/kxulsrwcq.com

whalesalad• 1 year ago

One of the CNAME's defined for that domain is "hiwd.kxulsrwcq.com" which appears to be flagged for malware. https://www.securefeed.com/Content/WebLookup?host=hiwd.kxuls...

supriyo-biswas• 1 year ago

Seems like it'd be a good addition to the Tranco list: https://tranco-list.eu/

joelesler• 1 year ago

They already are. Source: DNS Researcher myself.

tptacek• 1 year ago

Came here to say: if people are interested in this stuff, they should just pull down the Tranco list --- it includes feeds from Quad9 and Cloudflare.

peterdavehello• 1 year ago

In addition to Tranco, I maintain regularly updated lists of the top one million domains from sources like Cisco, Majestic, BuiltWith, Statvoo, DomCop, and Cloudflare. Feel free to check it out: https://github.com/PeterDaveHello/top-1m-domains

jeffbee2• 1 year ago

I don't see how it would be possible to produce this table under Quad9's privacy policy. Nothing in their privacy policy says that they maintain logs that would enable them to count queries by label. Can anyone explain?

danudey3• 1 year ago

I took a look at their privacy policy and agree that it doesn't specifically list that it logs which domains are being queried. It does list a bunch of things it does log as counters, all of which seems reasonable, but they don't explicitly say "we count which domains are being queried".

That said, I think it's entirely reasonable for them to log domains alone if they're completely disconnected from any user activity, i.e. a simple "increment the counter for foo.com" is reasonable since that's unrelated to user privacy.

staplers2• 1 year ago

Unless say, an adversary can link an obscure domain to a specific user/use case. Get that counter log and you can track a certain behavior (only pings this domain when about to do something or when on vacation, their house is empty, etc.)

ratorx• 1 year ago

It does say that they collect this information in their “Data and Privacy Policy”. Specifically section 2.2 (Data Collected): https://quad9.net/privacy/policy/

Which policy are you referring to that implies they don’t?

Also I think you are assuming they store query logs and then aggregate this data later. It is much simpler just to maintain an integer counter for monitoring as the queries come in, and ingest that into a time series database (not sure if that’s what they actually do). Maybe it needs to be a bit fancier to handle the cardinality of DNS names dimension, but re-constructing this from logs would be much more expensive.

jeffbee2• 1 year ago

I don't see how that is compatible with 2.2. They don't say anything about counters per label. It says counter per RR type, and watermarks of least and most recent timestamps by label, not count by label.

If an organization is going to be this specific about what they count, it implies that this is everything they count, not that there may also be other junk unmentioned.

yawndex• 1 year ago

The section you mentioned does not say anything about having counters for labels. It only mentions that they record "[t]he times of the first and most recent instances of queries for each query label".

GCUMstlyHarmls2• 1 year ago

transmissionbt.com (A bittorrent client for macOS) is out ranking youtube, wikipedia, github, etc. Is transmission that popular? I assume its the auto-updater? Seems insane.

https://github.com/Quad9DNS/quad9-domains-top500/blob/dfd513...

umpalumpaaa2• 1 year ago

Its available for Linux and Windows as well.

mekster5• 1 year ago

So are YouTube, Wikipedia and GitHub.

yegle• 1 year ago

It's likely the port open check that's built-in: https://portcheck.transmissionbt.com/443

VladVladikoff• 1 year ago

My guess is that DNS caching in web browsers prevents repeated lookup requests where as maybe the transmission implementation has no caching and does a lookup every time.

GCUMstlyHarmls2• 1 year ago

That makes the most sense.

1vuio0pswjnm72• 1 year ago

No JS:

https://raw.githubusercontent.com/Quad9DNS/quad9-domains-top...

JdeBP• 1 year ago

If people have naïvely configured their BIND client libraries to talk directly to Quad9, instead of via a machine-local forwarding caching proxy DNS server, then libcurl can be sending a re-query out to Quad9 every 60 seconds for domains that it actively needs to map to IP addresses.

* https://curl.se/libcurl/c/CURLOPT_DNS_CACHE_TIMEOUT.html

Excessive DNS traffic and the interaction with libcurl and with not having a machine-local forwarding caching proxy DNS server, is a known and open issue with that software.

* https://github.com/transmission/transmission/issues/1815

Having a machine-local forwarding caching proxy DNS server is in general a good idea. It provides exactly the sort of traffic concentration and redundancy elimination that is required by libcurl's 60 second re-queries, which is otherwise still traffic going out over a gateway even when Quad9 is co-located with one's ISP.

* https://jdebp.uk/FGA/dns-server-roles.html#ChoosingProxy

efitz• 1 year ago

shodan.io > gmail.com on 6/1 ???

xhrpost• 1 year ago

Has anyone used Quad9 and also NextDNS and have thoughts on how they compare?

trutz• 1 year ago

What is amazon.dev? Does not resolve for me.

{"position": 127, "domain_name": "amazon.dev", "date": "2025-07-10"}

Source: https://github.com/Quad9DNS/quad9-domains-top500/blob/main/t...

jvolkman• 1 year ago

https://www.google.com/search?q=%22amazon.dev%22

Looks like their customer support rep portal. Presumably there are not A/CNAME records at the top level, but na.headphones.whs.amazon.dev resolves.

angott• 1 year ago

I’m not entirely sure what it is, but my Alexa devices hit subdomains within it very frequently based on my local DNS history. That’s probably why it made the top of the list.

landl0rd• 1 year ago

The Cloudflare Radar page is probably a more representative sample: https://radar.cloudflare.com/domains

BrandoElFollito• 1 year ago

Why samsung.com is tagged "Home & Gardening" is a mystery :)

ricardbejarano• 1 year ago

Appliances I guess

Ey7NFZ3P0nzAe• 1 year ago

I'm surprised we are not seeing any porn site. What's going on?

wigster• 1 year ago

example.com #17 ?

paweladamczuk• 1 year ago

Funny, people don't bother reading RFCs

SoftTalker• 1 year ago

Vibe coders.

mekster5• 1 year ago

This just shows that domain is incorporated not just in documents but on systems that actually trigger accessing it all over the world.

onlyrealcuzzo• 1 year ago

It's quite interesting to me that ChatGPT is in the 200s and 300s.

By almost every metric this is one of the 10 busiest websites, and some sources are already putting it in the top 5.

Are they just disproportionately not using Quad9?

I understand that there's a lot of overlap with Google having several spots in the top 50 itself, several being infrastructure like cloudflare and akamai, and several others being malware - but it still seems surprising.

It's just kind of shocking to see Slack, Zoom, LinkedIn, and even DropBox, Roku, and Yandex much higher up.

QuinnyPig• 1 year ago

My theory: the domains you name have ad beacons, desktop apps that are persistently running, and/or physical devices plugged into networks out there. Whereas ChatGPT is used (domainwise) overwhelmingly by humans hitting the site in their browsers.

danielcid2• 1 year ago

Mostly because of sub domains. They are counting all the sub domains requests to give the top domains ranking.

Some of those have many trackers and background sub domains that add up.

For example, Linkedin their most popular sub domain is: px.ads.linkedin.com

Here is a more comprehensive list with top 10k domains (including sub domains):

https://dnsarchive.net/top-domains?rank=top10k

Bender2• 1 year ago

Something else to factor in is the TTL of both NS/A types for each apex domain and the individual records including sub-domains. Clients will not be querying Quad9 until the TTL expires on their clients. TTL would have to be factored into query rates to determine popularity correctly whereas these lists just show raw query numbers.

For example, there are many records under amazonaws.com that have 5 second TTL's mostly EC2 instances. As such clients will query them at a much higher rate whereas grammarly.io have a number of records with a 900 second TTL. This will skew the ranking positions of the two apex domains. I suppose if one wanted to game this they could have an A record to a non-critical part of a site that is not visibly rendered by the end-user and has a TTL of 1 second assuming quad9 is not rewrite min/max-ttl which some resolvers do.

Examples of just some of the TTL's used on these apex domains excluding individual records:

    30 32 60 300 600 900 1200 1800 3600 7200 10800 21600 28800 43200 86400 90000 3600000

Some examples of rewriting max-ttl I forgot which ones rewrite min-ttl:

    for Resolver in 1.1.1.1 8.8.8.8 9.9.9.9 216.128.176.142;do echo -en "${Resolver}:\t"; dig @${Resolver} +nocookie +noall +answer -t a big.ohcdn.net;done | column -t
    1.1.1.1:          big.ohcdn.net.  3628800  IN  A  227.227.227.227
    8.8.8.8:          big.ohcdn.net.  21422    IN  A  227.227.227.227
    9.9.9.9:          big.ohcdn.net.  43200    IN  A  227.227.227.227
    216.128.176.142:  big.ohcdn.net.  3628800  IN  A  227.227.227.227  # authoritative server

[Edit] I just realized they made a general statement to this effect in the git repo.

doubleorseven• 1 year ago

i also looked it up. it feels like up until ~200 those are all just chatty apps on our computers talking with the mother ship

mekster5• 1 year ago

Isn't part of the reasons to run a public DNS to sell these hard earned info for profit to marketers etc but they just release publicly? Of course this is just the tip of the iceberg of the information they gather.

Really interesting to know though.

Some just look way high up and could mean buggy implementation without proper cache usage or persistently banging the domain.

null0ranje• 1 year ago

Data in the aggregate is quite interesting and probably of little value to marketers.

mekster5• 1 year ago

Who are looking up PTR records?

54.in-addr.arpa looks to be Amazon's range and there are several others.

mccoyc• 1 year ago

It's probably a lot of automated tooling/monitoring infrastructure that's doing reverse resolution of IPs to get hostnames.

Edit: I've found that sometimes they're pretty poor at caching responses so you end up with a lot of these requests.

citrin_ru2• 1 year ago

Mail servers typically resolve a remote IP to a PTR. High number of PTR requests can indicate that the network is used to send email. Amazon (both SES and EC2) is one of the biggest email sources on the Internet (ranging from ham to marketing and there is huge spam volume from AWS too).

Thought I don’t expect mail servers to use quad9.

1vuio0pswjnm72• 1 year ago

As the comments here suggest, this list may be more indicative of some developer-introduced application behaviour, e.g., gratuitous DNS lookups, than "popularity".

Top DNS domains seen on the Quad9 recursive resolver array each day

Related Stories