Security Teams Face Noise Storm as Iranian DNS Tunneling Generates 40 Billion Observations

Organisations monitoring network traffic are confronting an unprecedented volume of data stemming from suspected Iranian VPN-over-DNS activity. According to a report by GBHackers published on 9 October 2026, this surge has generated 40 billion passive DNS observations. The scale of this event poses significant challenges for security teams trying to distinguish legitimate traffic from potential exfiltration or command-and-control channels during active military conflict.

What exactly happened during this DNS surge?

A single domain was responsible for generating 40 billion passive DNS observations within a matter of days. This massive spike in traffic was identified as part of a broader pattern of suspected VPN-over-DNS activity linked to Iranian infrastructure. The investigation, detailed by GBHackers, highlights how this specific domain became a focal point for an extraordinary volume of network queries.

The activity did not remain isolated to one address. The infrastructure expanded rapidly, spreading across more than 100 domains during the period of military conflict. This distribution suggests a coordinated effort to maintain connectivity or data transfer capabilities despite potential network restrictions or monitoring. The sheer volume of observations makes standard analysis difficult for defenders.

Who is affected and what is the purpose?

The primary impact falls on security operations centres and IT managers responsible for monitoring DNS traffic and filtering malicious domains. The sudden influx of 40 billion observations can overwhelm logging systems and alert thresholds, potentially masking other threats or causing false positives. Organisations with strict DNS filtering policies may also experience connectivity issues if legitimate services are inadvertently blocked by aggressive blocking rules.

The exact purpose of this activity remains unconfirmed. GBHackers noted that the operators behind the infrastructure, the specific content being transmitted, and the ultimate goal of the campaign have not been verified. While the method resembles VPN tunneling over DNS, the lack of confirmed payloads means defenders must treat the traffic as suspicious without definitive proof of data theft or malware delivery.

When did this activity begin and expand?

The suspected Iranian VPN-over-DNS activity began around 07:00 UTC in March. This timing coincides with the onset of military conflict, suggesting a direct correlation between geopolitical events and network behaviour. The rapid expansion of the infrastructure across more than 100 domains indicates a pre-planned or highly agile response to changing network conditions.

The report was published on 9 October 2026, providing a retrospective look at the event. By the time of disclosure, the scale of the operation was already evident in passive DNS datasets. The delay between the start of the activity and the public report allows for a clearer analysis of the infrastructure’s footprint and its evolution over time.

What should security teams do next?

Security teams should review their DNS logging and monitoring capabilities to ensure they can handle sudden spikes in traffic volume. Defenders must verify that their systems can distinguish between high-volume legitimate queries and potential tunneling attempts. It is crucial to maintain visibility into DNS traffic patterns without creating blind spots.

Teams should also assess their current DNS filtering policies to ensure they are not overly broad. Blocking entire ranges of domains based on volume alone can disrupt business operations. Instead, focus on identifying anomalous query patterns and unusual domain registration trends. Collaboration with threat intelligence providers can help validate suspicious domains.

What to do and how to stay safe: DNS

• Review DNS logs for unusual query volumes or patterns indicative of tunneling.
• Update firewall rules to monitor and rate-limit excessive DNS requests.
• Verify that DNS filtering policies are precise to avoid blocking legitimate services.
• Coordinate with threat intelligence feeds to identify known malicious domains.

Step-by-step guide: Indicators of compromise: how to detect hidden threats

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many DNS observations were generated by this activity?

One domain generated 40 billion passive DNS observations within days, according to GBHackers.

Who is behind this Iranian DNS activity?

The operators, transmitted content, and purpose remain unconfirmed, as stated in the report.

How many domains were involved in this infrastructure?

The infrastructure expanded across more than 100 domains during the military conflict.