Iranian VPN-over-DNS Activity Generates 40 Billion DNS Observations During Military Conflict

DomainTools observed an unprecedented surge of suspected VPN-over-DNS activity beginning 1 March 2026, with supaghost.cc generating up to 500,000 DNS observations per second and accumulating roughly 40 billion passive DNS observations before filtering; TXT record payload structures and delegation patterns suggested bidirectional DNS tunneling across >100 domains (many registered late 2025 and disproportionately using Iran’s .ir ccTLD), though content, operators, and attribution remain unconfirmed and DomainTools did not decode payloads.