DNSFilter
Reports
All Statistics
The DNSFilter network processed over 6 billion AI-related queries between October 2024 and September 2025.
New domains make up over 65% of unique threat domains.
Malicious or impersonation GenAI sites decreased by 92% from April 2024 to April 2025.
In October 2025, the education industry ranked third highest in proxy/filter-avoidance requests.
There was a 295% increase on November 8, 2025, in domains containing the term 'roblox'.
In school networks, traffic to proxy and filter avoidance categories increased by 83% on November 9, 2025, compared to the previous 12-month average.
Phishing and deception made up 31.6% of traffic on DNSFilter's network, marking an increase compared to the prior quarter. This amounted to over 750 million queries.
New domains accounted for nearly 40% of traffic requests categorized as malicious.
The DNSFilter network processed billions more DNS queries in Q2 2025 compared to the previous quarter. June specifically recorded the highest DNS traffic volume for that quarter.
DNSFilter blocked over 60 million generative AI requests in March.
In March, Notion accounted for 93% of all blocked generative AI queries, significantly more than the combined number for Microsoft Copilot, SwishApps, Quillbot, and OpenAI.
Since January 2024, DNSFilter has been processing a monthly average of over 330 million queries that fall under the generative AI category.
Traffic to threat sites that include the word "travel" spikes between May and June each year.
On May 8, 2024, traffic to threat sites that include the word "travel" peaked, marking 256% over the average between 2023 to April 2025.
On June 12, 2024, 3.46% of all traffic to domains with "vacation" in their name was blocked, which was the highest-ever percentage.
Threats on the DNSFilter network grew by 30% between October 2024 and September 2025.
DNSFilter blocked 44% more CSAM content in 2025 than in the previous year.
The average internet user encounters 66 threats per day, up from 29 threats per day.
GenAI traffic experienced a 102.13% month-over-month spike in September 2025.
The Internet Watch Foundation detected 26,362% more AI videos of CSAM in 2025 compared to 2024.
Malicious gaming-related domains rose by 462% on September 22, 2025, compared to the previous 12-month average.
Almost 4% of DNS traffic was blocked by DNSFilter, which is the highest percentage of blocked traffic on record.
Of the top five country code Top Level Domains (ccTLDs) identified as likely to be malicious, four were associated with island nations. Domains linked to the Faroe Islands (.fo) were the most prevalent, with 27% of their traffic deemed malicious. Other island nations high on this list included Grenada, Mayotte, and Wallis and Futuna.
Malware was identified as the second most trafficked threat category.
Almost 4% of DNS traffic was blocked by DNSFilter, which is the highest percentage of blocked traffic on record.
New domains accounted for nearly 40% of traffic requests categorized as malicious.
This number of blocked requests represented about 12% of all generative AI queries processed by DNSFilter in March.
There was a 2,000% rise in malicious sites containing "openai" in their name between April 2024 and April 2025
There was a 92% decrease in malicious and fake ChatGPT and other generative AI sites between April 2024 and April 2025.
Traffic to malicious sites with "travel" in the domain name was 235% higher between May and July 2024 than the overall average between 2023 and April 2025
In 2025, the largest spike in traffic to threat sites with travel terms in their name occurred on April 28, marking a 116% increase over the average since 2023.
Common terms used in malicious sites purporting to be legitimate travel sites include "Delta," "Spirit," "beach," "package," and "tour;" the top-trafficked vacation scam sites include the word "Mexico."