Aisuru IoT Botnet - Cloudflare DNS Rankings Manipulated
Category:Threat Alerts / Threat Intelligence
Aisuru botnet domains overtook Amazon, Apple, Google, and Microsoft in Cloudflare's public ranking of most frequently requested websites after the botnet's operators switched hundreds of thousands of infected IoT devices from Google's 8.8.8.8 DNS to Cloudflare's 1.1.1.1 resolver. The massive distributed denial-of-service platform, comprising compromised routers and security cameras, demonstrates attack capacity nearing 30 terabits per second. Cloudflare CEO Matthew Prince confirmed Aisuru's overlords are using the botnet both to boost malicious domain rankings and to simultaneously attack the company's DNS service. What's nasty: the surge in automated DNS queries pushed Aisuru command-and-control domains into Cloudflare Radar's top-ranked websites list, at times placing them above the world's largest tech companies. This polluted data feeds into broader ecosystems like TRANCO and safe browsing lists used by browsers, resolvers, and security products. Researchers at Infoblox and Epi warn that because rankings like Cloudflare Radar inform trust systems, botnet-generated noise can inadvertently promote malicious domains into "trusted" sets, indirectly weakening defenses for organizations that rely on popularity-based allowlists. Most Aisuru control servers are registered in the .su top-level domain—assigned to the former Soviet Union and created just 15 months before the fall of the Berlin Wall. According to Cloudflare's website, nearly 52 percent of DNS queries to top Aisuru domains originated from the United States, drawing most firepower from IoT devices hosted on U.S. Internet providers like AT&T, Comcast, and Verizon. The botnet relies on well more than a hundred control servers, exploiting simplistic ranking algorithms that equate query volume with popularity.
CORTEX Protocol Intelligence Assessment
Business Impact: Aisuru IoT botnet shows that large-scale IoT compromise can distort widely used domain reputation feeds, indirectly weakening the defenses of organizations that trust popularity-based allowlists. At the same time, its 30 Tbps-class DDoS capability poses a direct availability threat to online services, SaaS platforms, and critical infrastructure. Technical Context: The botnet's operators repointed infected devices to Cloudflare's 1.1.1.1 DNS resolver and flooded C2 domains with queries, exploiting simplistic ranking algorithms that equate volume with popularity. This manipulation highlights gaps in how security and trust systems distinguish between organic user behavior and automated malicious traffic at internet scale.
Strategic Intelligence Guidance
- Re-evaluate dependence on raw domain popularity lists for security decisions, ensuring that allowlists incorporate malware classification, hosting reputation, and behavioral analysis in addition to DNS volume.
- Collaborate with ISPs and device vendors to detect and remediate compromised IoT routers and cameras, using telemetry from DDoS scrubbing centers and DNS services to identify hotspots.
- Integrate volumetric and protocol-level DDoS protections in front of critical services, accounting for the potential scale of attacks launched by botnets like Aisuru.
- Track and block known Aisuru IoT botnet command-and-control domains and related infrastructure at DNS and network layers, updating indicators as new controller hosts appear.
Vendors
Threats
Targets
Impact
Data Volume:Hundreds of thousands of compromised IoT devices
Intelligence Source: Aisuru IoT Botnet - Cloudflare DNS Rankings Manipulated | Nov 6, 2025