validx[.]shop looked fine at first glance. "Normal" name servers, a real mail setup, nothing that immediately stood out at the apex level. One subdomain didn't quite fit, though. It was getting DNS queries that were absurdly long and frequent for a new domain that nobody was really visiting. Rather than that being web traffic, we detected it as likely tunneling. Turns out it wasn't a one-off. The same setup shows up on hundreds of other domains. The domain names follow a similar pattern: short, brandable and portmanteau-y (i.e., cordkit, zenithly, queuebox), spread across a long list of cheap gTLDs with the same registrar. The tunnel itself is answering with TXT records like: ⚠️ "H2;n=5;k=3;ol=2004;sz=800;cz=gz" As best as we can tell, that's a shard count, a reconstruction threshold, a length, a chunk size, and a compression flag. We checked the signature against a number of known DNS tunnelling tools and none of them write a header like this. We watched two more domains get registered mid-investigation, hours apart, which was fun to see and immediately block :ablobcatpopcorn: We've got the infrastructure and the method. We haven't got a payload, and we haven't matched this header format to anything documented publicly. Has anyone else run into this, recognize the TXT format above, or have a sample of a possible malware source? We'd like to hear from you. ⛔ validx[.]shop ⛔ cordkit[.]online ⛔ zenithly[.]best ☠️ 95[.]179[.]159[.]229 #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #c2