Our Quad9 documentation is now also available in #Romanian (https://docs.quad9.net/ro/) thanks to the help of our friend, Toma Minea (https://www.linkedin.com/in/toma-minea-86900582/).
ALT
Recent searches
Search options
Administered by:
#dns
50 posts44 participants1 post today
@DoctorBrodsky @woe2you @miah given #Quad9 bowed before the #Contentmafia and censored #DNS requests, I'll continue to recommend using #OpenNIC's Servers instead
94.103.153.176 & 2a02:990:219:1:ba:1337:cafe:3 as well as144.76.103.143 & 2a01:4f8:192:43a5::2
- If you only add a single #IPv4 address, no #IPv6 resolution will take place over said provider or worse even no IPv6 connectivity at all...
I merely retain quad9 on said list for archival purposes. I Yeeted #CloudFlare aka. #ClownFlare since they are a #RogueISP!
GitHublists.d/dns.servers.list.tsv at a4a7ccf70d8504ebbffd7e5fbcd5630294860434 · greyhat-academy/lists.dList of useful things. Contribute to greyhat-academy/lists.d development by creating an account on GitHub.
It has been 0 days since the last #DNS issue in my home lab.
I noticed that queries for the internally used domain started failing in #BIND9, even though the DNS behind that domain (AD DC) was responding correctly. I scoured through the logs with this handy little helper:
tail -f /var/named/log/* | grep --line-buffer mydomain.fake
> lame-servers: info: broken trust chain resolving 'somehost.mydomain.fake/A/IN'
#Phishing-as-a-service operation uses DNS-over-HTTPS for evasion
Malicious actors have taken notice of news about the US Social Security System. We've seen multiple spam campaigns that attempt to phish users or lure them to download malware.
Emails with subjects like "Social Security Administrator.", "Social Security Statement", and "ensure the accuracy of your earnings record" contain malicious links and attachments.
One example contained a disguised URL that redirected to user2ilogon[.]es in order to download the trojan file named SsaViewer1.7.exe.
Actors using social security lures are connected to malicious campaigns targeting major brands through their DNS records.
Block these:
user2ilogon[.]es
viewer-ssa-gov[.]es
wellsffrago[.]com
nf-prime[.]com
deilvery-us[.]com
wllesfrarqo-home[.]com
nahud[.]com.
#dns #lookalikes #lookalikeDomain #threatintel #cybercrime #threatintelligence #cybersecurity #infoblox #infobloxthreatintel #infosec #pdns #malware #scam #ssa
DNS requests aren't private by default! 
There's a new Web Standard in town! Meet WebMonetization - it aims to be a low effort way to help users passively pay website owners.
The pitch is simple. A website owner places a single new line in their HTML's <head> - something like this:
<link rel="monetization"…
⸻
#CyberSecurity #dns #HTML #standards #WebMonitization
Terence Eden’s Blog · How to prevent Payment Pointer fraudThere's a new Web Standard in town! Meet WebMonetization - it aims to be a low effort way to help users passively pay website owners. The pitch is simple. A website owner places a single new line in their HTML's <head> - something like this: HTML<link rel="monetization" href="https://wallet.example.com/edent" /> That address is a "Payment Pointer". As a user browses the web, their browser takes note of all the sites they've visited. At the end of the month, the funds in the user's digital…
I just glanced at something called a "Nintendo DS emulator", and I've understood it.
They have no DNSKEY, you see, so they have to emulate the DS.
Vous avez un peu d'expérience avec les IDN (Internationalized Domain Names), soit des noms de domaine contenant d'autres caractères que ceux ASCII ?
Je m'interroge surtout quant à leur compatibilité par rapport aux outils et aux logiciels. Les navigateurs, OK, ils les supportent tous, je n'ai pas à m'en faire.
Pour les API et autres outils, par contre...
https://www.mail-tester.com/test-p3tdhnk3o #Mail #TechFail #ChocolateTeapot #HackerNews #ngated
www.mail-tester.comSpam Test ResultYou sent us an email? Check here if it passed our tests
Our latest newsletter is out, get it while it's hot!
Key stories:
Get up to speed with these stories and more: https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne-2/
If you'd like to get the latest Cyber Security news wrapped up and delivered to your inbox every day, subscribe to our newsletter here!
Opalsec · Daily News Update: Saturday, March 29, 2025 (Australia/Melbourne)A breach at Oracle Health compromised patient data, with Oracle allegedly shifting responsibility to hospitals and avoiding documentation. A Walmart subsidiary is investigating claims of a Clop ransomware attack, potentially linked to the Cleo file transfer vulnerability.
howdy, #hachyderm!
over the last week or so, we've been preparing to move hachy's #DNS zones from #AWS route 53 to bunny DNS.
since this could be a pretty scary thing -- going from one geo-DNS provider to another -- we want to make sure *before* we move that records are resolving in a reasonable way across the globe.
to help us to do this, we've started a small, lightweight tool that we can deploy to a provider like bunny's magic containers to quickly get DNS resolution info from multiple geographic regions quickly. we then write this data to a backend S3 bucket, at which point we can use a tool like #duckdb to analyze the results and find records we need to tweak to improve performance. all *before* we make the change.
then, after we've flipped the switch and while DNS is propagating -- 
-- we can watch in real-time as different servers begin flipping over to the new provider.
we named the tool hachyboop and it's available publicly --> https://github.com/hachyderm/hachyboop
please keep in mind that it's early in the booper's life, and there's a lot we can do, including cleaning up my hacky code. 
attached is an example of a quick run across 17 regions for a few minutes. the data is spread across multiple files but duckdb makes it quite easy for us to query everything like it's one table.
ALT
We published a blog yesterday about a PhaaS and phishing kit that employs DoH and DNS MX records to dynamically serve personalized phishing content. It also uses adtech infrastructure to bypass email security and sends stolen credentials to various data collection spaces, such as Telegram, Discord, and email. https://blogs.infoblox.com/threat-intelligence/a-phishing-tale-of-doh-and-dns-mx-abuse/
Infoblox Blog · PhaaS actor uses DoH and DNS MX to dynamically distribute phishingLarge-scale phishing attacks use DoH and DNS MX records to dynamically serve fake login pages
Read: https://hackread.com/morphing-meerkat-phishing-kit-dns-spoof-brands/
Hackread - Latest Cybersecurity, Tech, AI, Crypto & Hacking News · New Morphing Meerkat Phishing Kit Exploits DNS to Spoof 100+ BrandsFollow us on Blue Sky, Mastodon Twitter, Facebook and LinkedIn @Hackread
Blocky : une solution légère pour bloquer les publicités et les sites malveillants sur un réseau https://www.it-connect.fr/blocky-une-solution-legere-pour-bloquer-les-publicites-et-les-sites-malveillants-sur-un-reseau/ #Cybersécurité #DNS
IT-Connect · Blocky : bloquez les publicités et les malwares sur un réseauApprenez à installer et à configurer Blocky sur Linux, un network ad-blocker open source capable de bloquer les pubss et les sites malveillants sur un réseau.
Last week, while reviewing detected lookalike domains, one in particular stood out: cdsi--simi[.]com. A quick search pointed him to a legitimate U.S. military contractor, CDSI, which specializes in electronic warfare and telemetry systems. It's legitimate domain cdsi-simi[.]com features a single hyphen, whereas the lookalike domain uses two hyphens.
Passive DNS revealed a goldmine: a cloud system in Las Vegas hosting Russian domains and other impersonations of major companies.
Here are a few samples of the domains:
- reag-br[.]com Lookalike for Reag Capital Holdings, Brazil.
- creo--ia[.]com Lookalike for an industrial fabrication firm in WA State.
- admiralsmetal[.]com Lookalike for US based metals provider.
- ustructuressinc[.]com Lookalike Colorado based Heavy Civil Contractor.
- elisontechnologies[.]com Typosquat for Ellison Technologies machine fabrication.
#dns #lookalikes #lookalikeDomain #threatintel #cybercrime #threatintelligence #cybersecurity #infoblox #infobloxthreatintel #infosec #pdns #phishing #malware #scam #dod
(infoblox.com) Morphing Meerkat: Advanced Phishing-as-a-Service Platform Using DNS MX Records for Tailored Attacks https://blogs.infoblox.com/threat-intelligence/a-phishing-tale-of-doh-and-dns-mx-abuse/
This report details the discovery of a sophisticated Phishing-as-a-Service (PhaaS) platform called 'Morphing Meerkat' that has been operating for at least five years. The platform leverages DNS mail exchange (MX) records to dynamically serve fake login pages tailored to victims' email providers, spoofing over 100 brands. The threat actor behind this operation sends thousands of spam emails, primarily through specific ISPs, exploits open redirects on adtech infrastructure, compromises WordPress sites, and uses multiple credential exfiltration methods including Telegram. The phishing kit includes advanced evasion techniques such as code obfuscation, anti-analysis measures, and dynamic translation capabilities supporting over a dozen languages to target users globally.
Infoblox Blog · PhaaS actor uses DoH and DNS MX to dynamically distribute phishingLarge-scale phishing attacks use DoH and DNS MX records to dynamically serve fake login pages
@gaufff With either choice, the most important thing is to make sure #dns is locked down and the end users can't just change the DNS settings to something other than your preferred DNS provider.
Basically you're going to need to block outbound port 53 traffic at the gateway unless it comes from one of your approved DNS servers