DNS Tunneling / Exfiltration Detector

Local · No API Cost

Length + entropy + query-volume heuristics on a pasted DNS log — real technique, no ML model

Paste a DNS query log — one hostname per line (the common format for a pasted dig/ resolver/Pi-hole export). Hostnames are grouped by parent domain and flagged only when at least two of three signals agree — subdomain length, Shannon entropy, and query volume — and entropy has to be one of them. Never a single signal alone, to avoid false-flagging ordinary long CDN-style subdomains.

Or check a single hostname on its own — a weaker signal than the log above, since real tunneling detection relies on volume/repetition a single query can't show.