Iranian VPN-over-DNS Activity Generates 40 Billion DNS Observations During Military Conflict
DomainTools traced 40 billion DNS observations to suspected Iranian VPN-over-DNS tunneling during a March 2026 conflict.
DomainTools reported that supaghost[.]cc generated up to 500,000 passive DNS observations per second starting around 07:00 UTC on March 1, 2026, eventually totaling about 40 billion observations. Most were TXT records structured like VPN-over-DNS transport, and similar activity later appeared across more than 100 domains, disproportionately Iran’s .ir domains registered in late 2025. The surge began about 24 hours after a reported U.S.-Israeli bombing campaign, but DomainTools did not decode the data and did not confirm the operators, contents, or purpose. The 40 billion figure counts DNS observations, not files or stolen data.
- supaghost[.]cc peaked near 500,000 DNS observations per second.
- TXT records matched VPN-over-DNS, but payloads were not decoded.
- Activity later spread to more than 100 domains, many under .ir.
- The spike followed reported U.S.-Israeli strikes; operators remain unconfirmed.
- Organizations
- DomainTools
- Countries
- IranUnited StatesIsrael
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | supaghost.cc | omainTools’ intake servers traced the processing backlog to supaghost[.]cc, which generated up to 500,000 observations per second. I |
From the original article
2 min read at gbhackers.com
A newly disclosed unprecedented surge in suspected Iranian VPN-over-DNS activity, with one domain generating 40 billion passive DNS observations within days. Published October 9, 2026, the investigation documents infrastructure expanding across more than 100 domains during military conflict, while leaving its operators, transmitted content, and purpose unconfirmed. The activity began around 07:00 UTC on March […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.