Non-Browser DoH Beaconing to Known DNS-over-HTTPS Providers

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects network communication to well-known public DNS resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9) or DNS queries for their domains, initiated by processes other than standard web browsers. This behavior is often associated with non-browser applications, potential C2 channels, or hidden network activity bypassing system DNS configurations.