Iranian Infrastructure Generates 40 Billion DNS Observations During Conflict
A surge in suspected Iranian VPN-over-DNS activity produced 40 billion passive DNS observations across 100 domains, according to a report published October 9, 2026.
Key points
- One domain generated 40 billion passive DNS observations within days of the activity starting.
- The infrastructure expanded across more than 100 domains during a period of military conflict.
- The operators, transmitted content, and specific purpose of the activity remain unconfirmed.
An unprecedented surge in suspected Iranian VPN-over-DNS activity generated 40 billion passive DNS observations during a recent military conflict, according to a report published October 9, 2026. The investigation, detailed by GBHackers, documents a massive expansion of infrastructure that utilized DNS protocols to facilitate connectivity while leaving key operational details unconfirmed.
The activity began around 07:00 UTC in March and escalated rapidly, with a single domain accounting for the bulk of the 40 billion observations within days. This volume represents a significant anomaly in global DNS traffic patterns, highlighting the scale of the infrastructure deployed. The report notes that the infrastructure expanded across more than 100 domains during the conflict period, suggesting a coordinated effort to maintain communication channels.
Context and Background
The investigation published by GBHackers highlights the technical magnitude of the event without attributing specific command structures or confirming the exact nature of the data transmitted. The use of DNS for VPN traffic is a known technique for bypassing network restrictions, but the sheer volume observed here is described as unprecedented. The report emphasizes that while the infrastructure is linked to Iranian actors, the specific operators behind the domains have not been identified.
The timing of the surge coincides with a period of military conflict, raising questions about the strategic purpose of the network expansion. Analysts noted that the activity left its operators, transmitted content, and ultimate purpose unconfirmed in the initial disclosure. This lack of clarity complicates immediate attribution and response efforts for security teams monitoring regional cyber activity.
Who Is Affected
Security professionals monitoring DNS traffic for anomalies are directly affected by this data surge, as it may trigger false positives or obscure other malicious activity. Organizations with infrastructure in or near the conflict zone may experience collateral impacts on DNS resolution stability. Network administrators relying on passive DNS data for threat intelligence need to account for this massive volume of noise when analyzing traffic patterns from March 2026.
The report does not specify any direct victims of malware or data theft, but the scale of the operation suggests a significant investment in evading censorship or surveillance. Entities tracking Iranian state-sponsored cyber activity must update their indicators of compromise to include the more than 100 domains identified in the expansion. The unconfirmed nature of the transmitted content means that the risk profile remains ambiguous for downstream observers.
What should you do?
Security teams should review their DNS logs for unusual volumes of queries to known Iranian infrastructure or newly registered domains associated with the conflict period. Organizations should ensure their DNS filtering policies are updated to reflect the identified domains, even if the specific threat payload is unknown. Monitoring for DNS-over-HTTPS or DNS-over-TLS traffic spikes can help identify similar evasion techniques in future incidents.
What to do and how to stay safe: Iran
- Review DNS query logs for spikes in traffic volume originating from or destined for regions associated with the conflict.
- Update firewall and DNS filtering rules to block traffic to the more than 100 domains identified in the GBHackers report.
- Monitor for unusual DNS tunneling patterns that may indicate VPN-over-DNS activity within your own network perimeter.
- Verify that passive DNS data sources are calibrated to handle high-volume noise events to prevent alert fatigue.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many DNS observations were generated by this activity?
The activity generated 40 billion passive DNS observations, with one domain accounting for the majority of this volume within days.
When did the VPN-over-DNS activity begin?
The activity began around 07:00 UTC in March, according to the investigation published by GBHackers on October 9, 2026.
Who are the operators behind this infrastructure?
The operators, transmitted content, and specific purpose of the activity remain unconfirmed, though the infrastructure is linked to Iranian actors.
