DNS Tunneling: 40 Billion Records From One Domain Signal Iranian Infrastructure Expansion
A single domain triggered 40 billion DNS records during a military conflict, signaling massive infrastructure expansion for suspected Iranian operators.
Key points
- One domain generated 40 billion passive DNS observations within days.
- Infrastructure expanded across more than 100 domains during the conflict.
- Operators, transmitted content, and specific purposes remain unconfirmed.
A massive surge in suspected Iranian VPN-over-DNS activity has created unprecedented noise in global DNS infrastructure. According to a report by GBHackers published on October 9, 2026, a single domain generated 40 billion passive DNS observations within a matter of days. This volume of traffic indicates a sophisticated effort to bypass network restrictions or exfiltrate data using standard DNS protocols as a covert channel.
How it unfolded
- Activity began around 07:00 UTC in March, marking the start of the observed campaign.
- The infrastructure expanded rapidly, utilizing more than 100 distinct domains during the military conflict.
- Analysts documented the surge but could not confirm the operators, content, or specific purpose.
Who is affected
Managed service providers and enterprise security teams face significant challenges in filtering this traffic. The sheer volume of 40 billion observations from a single domain creates substantial noise, potentially masking other malicious activities or legitimate anomalies. Because the operators and specific payloads remain unconfirmed, defenders cannot easily create precise blocklists based on content signatures. The expansion to over 100 domains suggests a resilient infrastructure designed to withstand takedown efforts or IP-based blocking.
The fix
No vendor patch or specific remediation guide has been confirmed for this infrastructure. The activity relies on standard DNS protocols, meaning traditional firewall rules may not distinguish it from legitimate traffic without deep packet inspection. Security teams must rely on behavioral analysis and volume thresholds to identify anomalies. Until the operators are identified and the specific domains are fully mapped, organizations should monitor for unusual DNS query volumes from internal hosts.
Background: Firewalls
A firewall is a network security device that monitors incoming and outgoing traffic. It applies a set of rules to allow or block data packets. This creates a barrier between trusted internal networks and untrusted external ones, stopping unauthorized access before it reaches your servers.
Read the full guide: How Firewalls Work: The Mechanics Behind Network Traffic Control
What to do and how to stay safe: DNS tunneling
- Monitor DNS query volumes for sudden spikes that deviate from baseline traffic patterns.
- Review logs for connections to newly registered or obscure domains associated with the conflict zone.
- Implement rate limiting on DNS resolvers to mitigate the impact of high-volume tunneling attempts.
- Validate that DNS traffic inspection tools are configured to detect protocol abuse and encapsulation.
Step-by-step guide: Difference Between Cyber Espionage and Cyber Warfare: How to Tell
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many DNS observations were generated by the activity?
A single domain generated 40 billion passive DNS observations within days, according to GBHackers.
Who is behind the Iranian DNS tunneling campaign?
The operators, transmitted content, and specific purpose of the activity remain unconfirmed.
When did the DNS tunneling activity begin?
The activity began around 07:00 UTC in March, prior to the October 9, 2026 report.
