DNS Tunneling via Long Base64-Encoded Subdomain Labels

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects DNS queries containing unusually long subdomains (50+ characters) encoded in Base64, which is a common technique used for command-and-control (C2) communication or data exfiltration via DNS tunneling.