English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

The domain name system (DNS) is a crucial backbone of the Internet andmillions of new domains are created on a daily basis. While the vast majorityof these domains are legitimate, adversaries also register new hostnames tocarry out nefarious purposes, such as scams, phishing, or other types ofattacks. In this paper, we present insights on the global utilization of DNSthrough a measurement study examining exclusively newly observed hostnames viapassive DNS data analysis. We analyzed more than two billion such hostnamescollected over a period of two months. Surprisingly, we find that only threesecond-level domains are responsible for more than half of all newly observedhostnames every day. More specifically, we found that Google's AcceleratedMobile Pages (AMP) project, the music streaming service Spotify, and a DNStunnel provider generate the majority of new domains on the Internet. DNStunneling is a covert channel technique to transfer arbitrary information overDNS via DNS queries and answers. This technique is often (ab)used by attackersto transfer data in a stealthy way, bypassing traditional network securitysystems. We find that potential DNS tunnels cause a significant fraction of theglobal DNS requests for new hostnames: our analysis reveals that nearly allresource record type NULL requests and more than a third of all TXT requestscan be attributed to DNS tunnels.  Motivated by these empirical measurement results, we propose and implement amethod to identify DNS tunnels via a step-wise filtering approach that relieson general characteristics of such tunnels (e.g., number of subdomains orresource record type). Using our approach on empirical data, we successfullyidentified 273 suspicious domains related to DNS tunnels, including two knownAPT campaigns (Wekby and APT32).

A Study of Newly Observed Hostnames and DNS Tunneling in the Wild