This report aggregates count data for all Internet IPv4 addresses seen in DNS “A” records over a 90‑day period, mapping how often each /24 netblock appears in DNS‑resolution traffic. DomainTools software enables this analysis by exposing DNSDB’s rich passive‑DNS dataset and advanced query features such as time fencing, summarization, and the “summarize” verb, which lets analysts efficiently scan and normalize counts across millions of /24 blocks. The platform then supports visual analysis via violin plots and Hilbert‑curve “heatmaps,” highlighting high‑volume “heavy‑hitter” networks while revealing long‑tail, low‑activity ranges. This capability helps researchers and defenders quickly spot anomalous traffic patterns, identify heavily used infrastructure, and prioritize deeper investigation

Join for free to read