Founder of CleanBrowsing, Sucuri, Trunc and OSSEC. Former VP Engineering, GoDaddy - CTO, Sucuri. Builder and breaker by heart...
#security #cleanbrowsing #dns #cdn #opensource #infosec
| Country | Canada |
| Website | https://dcid.me |
| Company | https://dnsarchive.net |
| DNS Filter | https://cleanbrowsing.org |
Interesting.. First scan for CVE-2025-53771 (latest Sharepoint vuln) on our logs was on July 16th, a few days before public disclosure.
172.174.82.132 16/Jul/2025:07:31:10 +0000 "GET /_layouts/15/ToolPane.aspx HTTP/1.1" "http://localhost" "Mozilla/5.0"
From a Microsoft IP address...
Attackers exploit a blind spot by hiding malware inside DNS records. This technique transforms the Internet DNS into an unconventional file storage system and distributes malware using dns records. Be careful and safe out there 😱 Almost nobody filters DNS. Another security nightmare.
Read more: Malware in DNS
https://dti.domaintools.com/malware-in-dns/
Anyone ever see this user agent on their web logs?
"Mozilla/5.0 (compatible; Google-Extended/1.0"
Supposed to be used by Google AI (Bard/Gemini), but don't see any hits for it anywhere.
Or maybe the articles written about it were written by AI...
Started a repo with the most common AI bots/crawlers IP addresses I see:
https://github.com/dcid/AI-bots/blob/main/data/ai-bot-ipaddresses-ranges.txt
Very basic, but a start. Would love ideas on what bots / IP ranges are missing.
Next, I will add some scripts to convert that data into a more useable format.
Pretty big issue:
Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware.
Extensions that get hijacked/bought are a common source of malware these days.
*Found some additional domains in the same IP address as them which might be connected:
Is there a central repository with AI bot crawler IP addresses and user agents somewhere?
I have a small one with the main AI products, but looking to expand.
Deploying Fridays at 5pm.. or
Deploying Mondays at 1am and going to sleep..
All valid ways to add some emotion to your life.
Expanded DNSArchive to also add web headers, CMS versions, links , css files, etc.
You can now search for it here:
https://dnsarchive.net/web-search
(in beta).
Ex:
All sites using PHP/5.2:
https://dnsarchive.net/web-search?q=PHP/5.2
And you can still do DNS specific search here:
Feedback welcome!
This is my PhD thesis
I did not ask for this
I did not consent to this
I did not approve of this
I was not compensated for this
I would not have advised this
I do not like this
And worst of all, the number of people who've read my thesis has still not increased.
nixCraft 🐧
Dean Burnett (that brains guy)