Cloudflare Scrubs Aisuru Botnet from Top Domains List

Cloudflare has begun redacting Aisuru botnet domain names from its Top Domains list after the domains briefly surged to the top alongside major brands, with Cloudflare saying the top lists include domains with organic activity as well as those with emerging malicious behavior. Aisuru is described as a rapidly growing botnet of hundreds of thousands of hacked IoT devices, including routers and security cameras, which has recently increased in size and firepower and is capable of launching near-record DDoS attacks.

The botnet originally used Google’s DNS servers (8.8.8[.]8) but switched in early October to Cloudflare’s 1.1.1[.]1, and over the past week its control domains began populating Cloudflare’s top domain rankings, with some top entries redacted. The majority of DNS queries to the top Aisuru domains, nearly 52 percent, originated from the United States, aligning with reports that IoT devices on U.S. providers were driving its activity.

Cloudflare’s actions come as experts note that the rankings are based on DNS query volume rather than actual web visits, and that the presence of malicious domains can undermine trust in the rankings, which are used for safety and protection across browsers and resolvers.