Sample report

What a completed ShadowDNS report looks like.

Every finding includes supporting evidence, affected devices, and recommended next steps.

Run yours

DNS Visibility Assessment

Sample DNS Dataset

Generated Jul 14, 2026 · 2,418,332 queries · 312 devices · 7-day window

DNS activity overview

Total DNS queries

2,418,332

Unique domains

18,204

Unique clients

312

Avg queries / client

7,751

Most active client

WS-ENG-014

Most queried domain

chatgpt.com

Top categories:AI tools · 9Shadow IT · 14DoH bypass · 2Newly registered · 4

AI tools in use

Shadow-IT apps

DNS security findings

Observations

47 devices resolved ChatGPT-related domains in the last 7 days.
TeamViewer and AnyDesk activity was observed on 6 endpoints.
12 devices queried newly registered domains. Review legitimacy and business justification.

Application visibility

Top applications observed in the uploaded DNS data. Metadata-classified entries use the application name reported by your upstream system; signature entries fall back to domain matching.

Application	Category	Devices	Queries	% of total	Source
Google Search	Search	287	412,804	17.07%	metadata
Microsoft Office	Productivity	271	318,104	13.16%	metadata
iCloud	Cloud Storage	142	188,402	7.79%	metadata
YouTube	Streaming	198	162,188	6.71%	metadata
Azure Cloud Services	Cloud	158	144,910	5.99%	metadata
Microsoft Defender Antivirus	Security	268	121,544	5.03%	metadata
Google Play	App Store	96	88,122	3.64%	metadata
ChatGPT	Generative AI	47	18,432	0.76%	metadata
TeamViewer	Remote Access	4	412	0.02%	metadata

Category distribution

Query volume grouped by application or domain category, taken directly from the uploaded dataset.

Search488,204 queries · 20.19% · 298 devices · 4 apps

Productivity401,812 queries · 16.62% · 281 devices · 7 apps

Cloud Storage312,104 queries · 12.90% · 218 devices · 6 apps

Streaming204,812 queries · 8.47% · 211 devices · 5 apps

Cloud188,204 queries · 7.78% · 198 devices · 8 apps

Security142,904 queries · 5.91% · 271 devices · 3 apps

CDN138,502 queries · 5.73% · 304 devices · 6 apps

Collaboration98,188 queries · 4.06% · 184 devices · 5 apps

Development72,004 queries · 2.98% · 64 devices · 9 apps

Generative AI41,022 queries · 1.70% · 88 devices · 9 apps

AI tool findings

Each detection is a match between observed DNS queries and a curated signature for the named tool.

ChatGPT · OpenAI

Jul 8 → Jul 14

high

Devices: 47
Queries: 18,432
Supporting domains: chatgpt.com, openai.com, oaistatic.com
Example devices: WS-ENG-014, WS-MKT-022, MAC-EXEC-001

Claude · Anthropic

Jul 9 → Jul 14

high

Devices: 12
Queries: 4,211
Supporting domains: claude.ai, anthropic.com
Example devices: WS-ENG-014, WS-ENG-007

Gemini · Google

Jul 8 → Jul 14

high

Devices: 24
Queries: 6,502
Supporting domains: gemini.google.com, generativelanguage.googleapis.com
Example devices: WS-MKT-022, laptop-22, workstation-01

Cursor · Anysphere

Jul 10 → Jul 14

medium

Devices: 4
Queries: 1,287
Supporting domains: cursor.sh
Example devices: WS-ENG-014, WS-ENG-007

Windsurf · Codeium

Jul 12 → Jul 14

medium

Devices: 2
Queries: 612
Supporting domains: codeium.com
Example devices: WS-ENG-007

Perplexity · Perplexity

Jul 8 → Jul 14

high

Devices: 9
Queries: 1,944
Supporting domains: perplexity.ai
Example devices: WS-MKT-022, MAC-EXEC-001

DeepSeek · DeepSeek

Jul 11 → Jul 13

medium

Devices: 3
Queries: 421
Supporting domains: deepseek.com
Example devices: WS-ENG-014

Copilot · Microsoft

Jul 8 → Jul 14

high

Devices: 31
Queries: 7,810
Supporting domains: githubcopilot.com, copilot.microsoft.com
Example devices: WS-ENG-014, WS-ENG-007, WS-MKT-022

Midjourney · Midjourney

Jul 12 → Jul 14

low

Devices: 2
Queries: 188
Supporting domains: midjourney.com
Example devices: WS-MKT-022

Shadow IT findings

Dropbox

File sharing

medium

Devices: 18
Queries: 3,902
Supporting domains: dropbox.com, dropboxusercontent.com
Example devices: WS-MKT-022, WS-FIN-008

Observed · Dropbox-related domains were observed in DNS activity from 18 endpoints, totaling 3,902 queries.

Why highlighted · The application is categorized as File sharing and may warrant review against organizational software policies.

Suggested review · Confirm whether Dropbox use is approved within the environment.

WeTransfer

File sharing

medium

Devices: 11
Queries: 1,204
Supporting domains: wetransfer.com
Example devices: WS-MKT-022

Observed · WeTransfer-related domains were observed in DNS activity from 11 endpoints, totaling 1,204 queries.

Why highlighted · The application is categorized as File sharing and may warrant review against organizational software policies.

Suggested review · Confirm whether WeTransfer use is approved within the environment.

Notion

Productivity

low

Devices: 22
Queries: 2,810
Supporting domains: notion.so
Example devices: WS-ENG-014, WS-MKT-022

Observed · Notion-related domains were observed in DNS activity from 22 endpoints, totaling 2,810 queries.

Why highlighted · The application is categorized as Productivity and may warrant review against organizational software policies.

Suggested review · Confirm whether Notion use is approved within the environment.

Discord

Messaging

medium

Devices: 14
Queries: 3,188
Supporting domains: discord.com, discordapp.com
Example devices: WS-ENG-007

Observed · Discord-related domains were observed in DNS activity from 14 endpoints, totaling 3,188 queries.

Why highlighted · The application is categorized as Messaging and may warrant review against organizational software policies.

Suggested review · Confirm whether Discord use is approved within the environment.

TeamViewer

Remote access

high

Devices: 4
Queries: 412
Supporting domains: teamviewer.com, ping.teamviewer.com
Example devices: WS-FIN-008, MAC-EXEC-001

Observed · TeamViewer-related domains were observed in DNS activity from 4 endpoints, totaling 412 queries.

Why highlighted · The application is categorized as Remote access and may warrant review against organizational software policies.

Suggested review · Confirm whether TeamViewer use is approved within the environment.

AnyDesk

Remote access

high

Devices: 2
Queries: 188
Supporting domains: anydesk.com
Example devices: WS-FIN-008

Observed · AnyDesk-related domains were observed in DNS activity from 2 endpoints, totaling 188 queries.

Why highlighted · The application is categorized as Remote access and may warrant review against organizational software policies.

Suggested review · Confirm whether AnyDesk use is approved within the environment.

Google Drive (personal)

Storage

medium

Devices: 9
Queries: 1,402
Supporting domains: drive.google.com
Example devices: WS-MKT-022

Observed · Google Drive (personal) domains were observed in DNS activity from 9 endpoints, totaling 1,402 queries.

Why highlighted · The application is categorized as Storage and may warrant review against organizational software policies.

Suggested review · Confirm whether personal Google Drive use is approved within the environment.

DNS security findings

Detections derived from DNS query content, response codes, and curated indicator feeds.

Newly registered domains

12 devices contacted newly registered domains

high

Affected devices: WS-MKT-022, WS-FIN-008, MAC-EXEC-001, +9 others
Query volume: 230
Example domains: secure-login-portal.xyz, account-verify-now.top, ms365-auth.click

Observed

12 endpoints resolved 3 domains registered within the last 14 days, totaling 230 queries.

Why highlighted

Domains registered in the last 14 days are surfaced by the newly-registered-domain rule, which references the WHOISDS feed.

Suggested review

Review the affected endpoints and domains to determine whether the activity is expected or warrants follow-up.

Evidence

Domain match against the WHOISDS newly-registered-domains feed (rolling 14 days).

DNS-over-HTTPS

DNS-over-HTTPS bypass detected on 7 devices

medium

Affected devices: WS-ENG-014, WS-ENG-007, +5 others
Query volume: 3,916
Example domains: 1.1.1.1, dns.google, cloudflare-dns.com

Observed

3,916 queries to known public DNS-over-HTTPS providers were observed from 7 endpoints.

Why highlighted

Public DNS-over-HTTPS services can bypass centralized DNS visibility and policy controls.

Suggested review

Verify whether the affected endpoints are expected to use external DNS resolution and whether it aligns with organizational DNS policy.

Evidence

Query destinations match a curated list of public DoH/DoT resolver hostnames.

NXDOMAIN activity

Unusual NXDOMAIN volume on 3 endpoints

medium

Affected devices: WS-ENG-014, WS-FIN-008, WS-MKT-022
Query volume: 612
Example domains: —

Observed

3 endpoints generated elevated NXDOMAIN activity, totaling 612 responses.

Why highlighted

Elevated NXDOMAIN activity may indicate DNS hygiene issues, failed lookups, outdated references, or other operational conditions that may warrant review.

Suggested review

Review the affected endpoints to determine whether the failed lookups are expected or require follow-up.

Evidence

Per-device NXDOMAIN count exceeds the 50-response threshold across the observation window.

Top clients

Client	Queries	Unique domains	% of total	Note
WS-ENG-014	84,201	1,842	3.48%	Developer workstation
WS-MKT-022	41,812	902	1.73%	Heavy SaaS user
MAC-EXEC-001	22,104	612	0.91%	Senior staff laptop
WS-FIN-008	18,904	421	0.78%	Finance — review remote access

Top queried domains

Domain	Category	Devices	Queries	First seen	Last seen
chatgpt.com	AI tool	47	12,481	Jul 8	Jul 14
githubcopilot.com	AI tool	31	7,810	Jul 8	Jul 14
gemini.google.com	AI tool	24	6,502	Jul 8	Jul 14
claude.ai	AI tool	12	4,211	Jul 9	Jul 14
dropbox.com	Shadow IT	18	3,902	Jul 8	Jul 14
discord.com	Shadow IT	14	3,188	Jul 8	Jul 14
1.1.1.1	DoH bypass	7	2,104	Jul 8	Jul 14
dns.google	DoH bypass	5	1,812	Jul 8	Jul 14
secure-login-portal.xyz	Newly registered	4	142	Jul 12	Jul 14
account-verify-now.top	Newly registered	3	88	Jul 13	Jul 14

Recommended next steps

Review newly registered domains for phishing and stage-1 droppers.
Confirm ownership and business justification for remote-access tools.
Investigate endpoints generating excessive NXDOMAIN responses.
Validate DNS-over-HTTPS usage and enforce a corporate resolver policy.
Reconcile AI tool usage against your acceptable-use and data-handling policy.