Interesting article: CNAME Cloaking

[trish]

Thank you Peter,
Oh yes almost every Wordpress website is using Cloudflare.

I see these fellows are thinking about a similar idea,

URL Filter and self updating blacklists?

Yes it can. Read the NXDOMAIN part of the information. Unbound can’t return an IP for these cases, it has to reject at the domain level, so you turn this on by setting the return to be something other than an IP address. Valid returns are listed on the page, but something like -r always_nxdomain will do what you want. Word of caution, I found this to be too restrictive. Many of the blocklists that are maintained by individuals or small teams are not the most accurate, and once a domain add…

@mutley created a script that can do CNAME inspection:

GitHub - sfeakes/ipfire-scripts: Scripts for ipfire

@pmueller

an up-to-date list of these tracking subdomains at hand.

I wonder if this would help. This list is being updated every morning at 5:00 UTC
https://hosts.oisd.nl/basic/ with 60000 domains
or even the full list
https://hosts.oisd.nl/ with 1.8 million domains

If anyone is interested, here are some partial screenshots regarding the list: