Quad9’s threat report for the first half of 2026 puts a striking number on hidden activity across home networks: the service received more than 14 billion DNS queries for only its 50 most-blocked domains between January and June.
The total covers botnets on Android TV devices, impersonation domains, notification scams, malvertising, and cryptocurrency mining. It also explains why speed cannot be the only criterion for selecting a resolver. Protective DNS can stop a malicious connection before a browser or app reaches an attacker’s server.
There is one essential caveat. Fourteen billion queries do not equal 14 billion victims or successful attacks. Automated lookups repeat, one infected device can produce millions of them, and caching behavior varies. Quad9 explicitly says its telemetry measures blocked queries, not compromised devices.
Which threats produced the most queries?
The leading groups in Quad9’s report include:
- CrowdStrike impersonation: 13 domains tied to opportunistic campaigns generated more than 4.6 billion queries, nearly two years after the 2024 Falcon outage;
- Android TV botnets: six algorithmically generated domains produced close to 2.2 billion queries while command-and-control infrastructure rotated;
- notification scams and malvertising: the analyzed ecosystem accounted for about 1.8 billion queries;
- cryptojacking: four Monero mining-pool hostnames received 688 million queries combined;
- fake Meta support: a domain used for phishing and spam still received more than 146 million queries, with Türkiye and Brazil among the largest sources.
The figures reveal two distinct patterns. Some campaigns reuse a small set of domains for a long time. Others use domain generation algorithms, or DGAs, to create and discard names rapidly in an attempt to outrun blocklists.
How DNS blocking protects a device
Before loading a page, downloading a script, or contacting a botnet controller, a device usually has to turn a hostname into an IP address. A protective resolver checks that request against continuously updated threat signals.
When it identifies a malicious domain, it withholds the normal address. Depending on the service and configuration, the answer might be NXDOMAIN, REFUSED, 0.0.0.0, or another synthetic result. Without an IP address, the connection to known infrastructure stops early.
This is especially useful for televisions, cameras, routers, and other devices that cannot run conventional endpoint security. Router-level configuration can also cover the whole home network.
DNS filtering still has limits. It does not stop direct IP connections, may not recognize a new threat, and cannot replace patching, antivirus, strong authentication, or device isolation. An app that bypasses network DNS through its own encrypted resolver may bypass the local policy too.
Why a benchmark can misread a successful block
A simplistic test may count every result other than an IP address as an error. On a filtering resolver, that penalizes the security feature for working correctly.
For an accurate performance comparison:
- Use neutral, controlled domains. Keep malware lists out of the availability dataset.
- Separate policy responses from timeouts. A fast
NXDOMAINis not the same as no response. - Compare equivalent variants. Quad9 offers endpoints with different policies; confirm the exact address under test.
- Record average, P95, and jitter. A low average can hide disruptive latency spikes.
- Test on the real network. Routes and point-of-presence proximity change across ISPs, Wi-Fi, and mobile data.
The report does not prove Quad9 is faster than Cloudflare, Google, or an ISP resolver. It demonstrates an active security layer. Performance still needs local measurement. You can also read how DNS over QUIC and HTTP/3 changed Quad9.
What to do when your network has repeated blocks
One block might follow a phishing link that caused no further harm. A persistent lookup pattern, especially every few seconds, deserves investigation.
Start by identifying the source device in router, firewall, or enterprise resolver logs. Update its operating system and apps, remove unknown extensions, and pay particular attention to inexpensive IoT hardware or TV boxes. Merely switching DNS can hide the symptom without removing the infection that keeps trying to connect.
In an organization, preserve the timestamp, queried name, source device, and response. That evidence helps correlate DNS activity with other alerts. Do not open a suspicious domain manually just to see what happens; use approved security tools and incident-response procedures.
Measure security and speed separately
The fastest DNS is not always the best choice, and protective DNS is not automatically slow. These are separate axes:
| Criterion | What to examine |
|---|---|
| Performance | average, P95, jitter, and consistency throughout the day |
| Availability | timeouts and genuine failures for neutral domains |
| Security | source quality, update speed, and blocking policy |
| Privacy | data retention, telemetry purpose, and encryption support |
| Compatibility | internal names, parental controls, and device protocol support |
The report’s most important lesson is not just the 14 billion total. It is the persistence: compromised devices continue contacting malicious infrastructure automatically when nobody is browsing. Protective DNS reduces that exposure; a well-designed benchmark verifies that it provides the protection with consistent performance on your connection.
