Cloudflare Scrubs Aisuru Botnet from Top Domains List
Summary: Domains tied to the Aisuru botnet, which comprises hundreds of thousands of hacked IoT routers and cameras, repeatedly displaced Amazon, Apple, Google and Microsoft in Cloudflare's public ranking of most-requested websites, prompting Cloudflare to redact the malicious domains and later hide them from the web version of the list. Cloudflare CEO Matthew Prince said the ranking system simply measures DNS query volume to 1.1.1.1, and that the attacker is generating a flood of requests both to influence the ranking and to attack the company's DNS service.
What's compelling: Cloudflare Radar feeds TRANCO's top-million domain list and is used by browsers, DNS resolvers and safe-browsing APIs for trust decisions, so a botnet controller sitting at #1 can propagate into systems that treat top-ranked domains as safe. Roughly 52 percent of queries to the top Aisuru domains originated from the United States, drawn from IoT devices on U.S. providers including AT&T, Comcast and Verizon.
Read the original at Krebs on Security ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026