Super interesting blogpost by DomainTools
"Looking closer, the engineer noted the flood originated with a single domain, and that one domain now accounted for up to 500,000 observations per second on our network."
"To me, this largely looked like a very voluminous emergency offsite backup."
https://dti.domaintools.com/securitysnacks/it-always-comes-back-to-dns-iranian-vpn-over-dns-activity-in-the-2026-conflict
hakan “:verified:”
npub1u2…v8zpj
2026-10-12 13:06:15 UTC
Author Public Key
npub1u2vjcwlxklwlnwe2xhvvnfntxueqyxgyjamg2fj68amqn8t8k3rq5v8zpjSeen on
wss://relay.momostr.pinkPublished at
2026-10-12 13:06:15 UTCEvent JSON
{
"id": "29ae7d3e7ca981f84649d9bf87a0abb6d121acc55ffaaf91f0d293cf099bceda",
"pubkey": "e2992c3be6b7ddf9bb2a35d8c9a66b3732021904977685265a3f76099d67b446",
"created_at": 1791810375,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@hatr/117428084753421056",
"web"
],
[
"proxy",
"https://infosec.exchange/users/hatr/statuses/117428084753421056",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/hatr/statuses/117428084753421056",
"pink.momostr"
],
[
"-"
]
],
"content": "Super interesting blogpost by DomainTools\n\n\"Looking closer, the engineer noted the flood originated with a single domain, and that one domain now accounted for up to 500,000 observations per second on our network.\"\n\n\"To me, this largely looked like a very voluminous emergency offsite backup.\"\n\nhttps://dti.domaintools.com/securitysnacks/it-always-comes-back-to-dns-iranian-vpn-over-dns-activity-in-the-2026-conflict",
"sig": "35d437398461ce6a89018913b01d5cced22fa96d6c2490d1096ae64e002244554e148c528d1c890037dda63faae4e7b9b73245e6d260afab80c742a9515f5c35"
}