4 ms·

Relatively often, actually. For instance, on this link on HN: https://medium.com/@bchesky/7-rejections-7d894cbaa084 https://medium.com/@bchesky/7-rejections-7d

• jbuzbee 11y ago
  That seems a bit different. A unique subdomain for each web page load might be common, but from my reading of the article, it looks like every packet of the tunneled conversation gets a unique domain. So for transferring any amount of data, I'd expect to see hundreds (thousands?) of subdomain resolution queries in a few minutes. That could raise a red flag. I suppose if the malware wanted to be more stealthy, it could slow transfers way down, intermix unrelated queries and spread the tunnel across multiple unrelated controlled domains.
  • TheLoneWolfling 11y ago
    As you said, you can do slow data transfer extremely easily and stealthily with this method. Bulk data transfer, not so much.