GBHackers: 40 Billion DNS Records Emerge From Single Domain Amidst Conflict Expansion

GBHackers reported an unprecedented surge in suspected Iranian VPN-over-DNS activity on October 9, 2026. The investigation documents a massive expansion of infrastructure across more than 100 domains during an ongoing military conflict.

What happened

The activity began around 07:00 UTC on March of the current year, according to the GBHackers report. This initial start date marks the beginning of a sustained campaign that utilized DNS protocols for data transport. The scale of the operation became apparent through passive DNS observation data collected by security researchers.

One specific domain within this infrastructure generated 40 billion passive DNS observations within a matter of days. This volume of traffic represents a significant anomaly in standard DNS usage patterns for that period. The sheer number of queries suggests automated or high-volume data exfiltration mechanisms were in place.

The investigation documented the infrastructure expanding across more than 100 distinct domains during the military conflict. This rapid proliferation indicates a distributed approach to maintaining connectivity despite potential network disruptions. The use of multiple domains likely served to evade simple blocking measures by defenders.

The report published on October 9, 2026, leaves several critical details unconfirmed. The identity of the operators behind the infrastructure remains unknown at this time. Researchers could not determine the specific content transmitted through these DNS tunnels.

The exact purpose of the VPN-over-DNS activity was also not confirmed in the findings. While the method suggests circumvention of network controls, the strategic intent is unclear. The ambiguity complicates the assessment of the threat level for external networks.

Why it matters

Security operations teams must account for high-volume DNS tunneling during periods of geopolitical instability. The use of standard protocols like DNS makes detection difficult without specialized monitoring tools. Traditional firewalls often allow DNS traffic by default, creating a blind spot.

The generation of 40 billion observations by a single domain highlights the resilience of this method. Such volume can overwhelm logging systems and obscure malicious activity among legitimate queries. Defenders may struggle to distinguish between normal high-traffic sites and tunneling endpoints.

The expansion to over 100 domains demonstrates the adaptability of the threat actors. Blocking individual domains becomes an ineffective strategy when new ones appear rapidly. This behavior requires a shift from signature-based blocking to behavioral analysis.

The unconfirmed nature of the operators and content adds uncertainty to threat intelligence. Teams cannot rely on known indicators of compromise for this specific campaign. The lack of clarity necessitates broader monitoring of anomalous DNS behaviors rather than specific IOCs.

Our take on the response

• Monitor for sudden spikes in DNS query volume from internal hosts.
• Implement strict egress filtering for DNS traffic to approved resolvers.
• Analyze DNS payload sizes and entropy for signs of tunneling.
• Review logs for connections to newly registered or suspicious domains.

Background: Indicators of compromise

Indicators of compromise are static data points that suggest malicious activity but lack context. Misreading them as definitive proof leads to alert fatigue and missed threats. You must combine them with behavioral analysis and contextual data to distinguish between benign anomalies and actual intrusions.

Read the full guide: Indicators of Compromise: 6 Common Misreadings That Fail in Detection

What to do and how to stay safe: DNS tunneling

• Audit current DNS egress policies to ensure only authorized resolvers are permitted for outbound traffic.
• Configure network monitoring tools to alert on unusually large DNS response sizes or high query rates.
• Inspect DNS packet payloads for encoded data that exceeds standard record length expectations.
• Review firewall logs for connections to domains registered shortly before the onset of the conflict.

Step-by-step guide: How the MITRE ATT&CK Framework Works for Detection

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many DNS observations did the primary domain generate?

The single domain generated 40 billion passive DNS observations within days, according to GBHackers.

When did this DNS tunneling activity begin?

The activity began around 07:00 UTC on March of the year the conflict occurred.

Who are the operators behind this infrastructure?

The operators, transmitted content, and purpose of the activity remain unconfirmed in the report.