DNS Log Desk - find DNS tunnelling, DGA domains and C2 beacons in a DNS query log

Paste a DNS query log from Zeek, BIND, dnsmasq or Pi-hole, a Windows DNS Server debug log, a SIEM or Umbrella CSV, or Route 53 Resolver JSON. Free in your browser: subdomain length, entropy, label alphabet and capacity, TXT share, DGA names and NXDOMAIN bursts per host, beacon timing, volume outliers and DoH lookups. Then a hunt gives the verdict, the hosts, what could have left, the expected noise and what to contain, checked against the log. Derived from the agent skill @mukul975/analyzing-dns-logs-for-exfiltration (Apache-2.0).

Every public app is built from a security-scanned skill and must pass a clean scan — skill and frontend — before it can be listed. Have a skill of your own? Turn it into an app — or read the step-by-step walkthrough.