Dns wildcard beaconing

A method comprising:

• receiving a plurality of domain name resolution requests from a plurality of resolvers, each of the domain name resolution requests comprising a network address of the resolver that sent the domain name resolution request and a hostname to resolve comprising a unique wildcard portion;
• storing first information representing associations between at least the unique wildcard portions of the plurality of domain name resolution requests and the network addresses of the plurality of resolvers;
• receiving a plurality of resource requests from a plurality of clients, each of the resource requests comprising a network address of the client that sent the resource request and at least the unique wildcard portion received in one of the plurality of domain name resolution requests;
• storing second information representing associations between at least the unique wildcard portions of the plurality of resource requests and the network addresses of the plurality of clients;
• and
• based on the first information and the second information, associating each of the plurality of clients with one of the plurality of resolvers;
• storing third information representing the associations between the plurality of clients and the plurality of resolvers;
• wherein the method is performed by one or more computing devices.

One or more non-transitory computer-readable media storing instructions which, when executed by one or more computing devices, cause the one or more computing devices to perform a method comprising:

• receiving a network request from a resolver to resolve a hostname, the network request from the resolver comprising a network address of the resolver, the hostname comprising a unique wildcard portion;
• storing first information representing an association between at least the unique wildcard portion and the network address of the resolver;
• receiving a network request from a client for a resource, the network request from the client comprising a network address of the client and at least the unique wildcard portion;
• storing second information representing an association between at least the unique wildcard portion and the network address of the client;
• based on the first information and the second information, associating the client with the resolver;
• and
• storing third information representing the association between the client and the resolver.

One or more non-transitory computer-readable media storing instructions which, when executed by one or more computing devices, cause the one or more computing devices to perform a method comprising:

• receiving a plurality of domain name resolution requests from a plurality of resolvers, each of the domain name resolution requests comprising a network address of the resolver that sent the domain name resolution request and a hostname to resolve comprising a unique wildcard portion;
• storing first information representing associations between at least the unique wildcard portions of the plurality of domain name resolution requests and the network addresses of the plurality of resolvers;
• receiving a plurality of resource requests from a plurality of clients, each of the resource requests comprising a network address of the client that sent the resource request and at least the unique wildcard portion received in one of the plurality of domain name resolution requests;
• storing second information representing associations between at least the unique wildcard portions of the plurality of resource requests and the network addresses of the plurality of clients;
• and
• based on the first information and the second information, associating each of the plurality of clients with one of the plurality of resolvers;
• storing third information representing the associations between the plurality of clients and the plurality of resolvers.

A system comprising:

• one or more processors and memory;
• an authoritative domain name resolver module configured to receive a network request from a resolver to resolve a hostname, the network request from the resolver comprising a network address of the resolver, the hostname comprising a unique alphanumeric sequence;
• the authoritative domain name resolver module further configured to store first information representing an association between at least the unique alphanumeric sequence and the network address of the resolver, in response to receiving the network request from the resolver;
• a web server module configured to serve a first resource to a client, the first resource comprising at least the unique alphanumeric sequence;
• the web server module further configured to receive a network request from the client for a second resource, the network request from the client comprising a network address of the client and at least the unique alphanumeric sequence served to the client as part of the first resource;
• the web server module further configured to serve the second resource to the client in response to receiving the network request from the client;
• the web server module further configured to store second information representing an association between at least the unique alphanumeric sequence and the network address of the client, in response to receiving the network request from the client;
• an aggregation server module configured to associate the client with the resolver, based on the first information and the second information;
• and
• the aggregation server module further configured to store third information representing the association between the client and the resolver;
• a load balancing server module further configured to select, based on the third information or information derived from the third information, network addresses to resolves hostnames to, in response to receiving requests to resolve the hostnames from the resolver.