DNSFilter

The DNSFilter network processed over 6 billion AI-related queries between October 2024 and September 2025.

DNSFilter blocked 44% more CSAM content in 2025 than in the previous year.

GenAI traffic experienced a 102.13% month-over-month spike in September 2025.

The average internet user encounters 66 threats per day, up from 29 threats per day.

New domains make up over 65% of unique threat domains.

The Internet Watch Foundation detected 26,362% more AI videos of CSAM in 2025 compared to 2024.

Malicious or impersonation GenAI sites decreased by 92% from April 2024 to April 2025.

Threats on the DNSFilter network grew by 30% between October 2024 and September 2025.

In October 2025, the education industry ranked third highest in proxy/filter-avoidance requests.

There was a 295% increase on November 8, 2025, in domains containing the term 'roblox'.

In school networks, traffic to proxy and filter avoidance categories increased by 83% on November 9, 2025, compared to the previous 12-month average.

Malicious gaming-related domains rose by 462% on September 22, 2025, compared to the previous 12-month average.

Phishing and deception made up 31.6% of traffic on DNSFilter's network, marking an increase compared to the prior quarter. This amounted to over 750 million queries.

New domains accounted for nearly 40% of traffic requests categorized as malicious.

The DNSFilter network processed billions more DNS queries in Q2 2025 compared to the previous quarter. June specifically recorded the highest DNS traffic volume for that quarter.

Malware was identified as the second most trafficked threat category.

Of the top five country code Top Level Domains (ccTLDs) identified as likely to be malicious, four were associated with island nations. Domains linked to the Faroe Islands (.fo) were the most prevalent, with 27% of their traffic deemed malicious. Other island nations high on this list included Grenada, Mayotte, and Wallis and Futuna.

Almost 4% of DNS traffic was blocked by DNSFilter, which is the highest percentage of blocked traffic on record.

Almost 4% of DNS traffic was blocked by DNSFilter, which is the highest percentage of blocked traffic on record.

New domains accounted for nearly 40% of traffic requests categorized as malicious.

DNSFilter blocked over 60 million generative AI requests in March.

In March, Notion accounted for 93% of all blocked generative AI queries, significantly more than the combined number for Microsoft Copilot, SwishApps, Quillbot, and OpenAI.

Since January 2024, DNSFilter has been processing a monthly average of over 330 million queries that fall under the generative AI category.

This number of blocked requests represented about 12% of all generative AI queries processed by DNSFilter in March.

There was a 92% decrease in malicious and fake ChatGPT and other generative AI sites between April 2024 and April 2025.

There was a 2,000% rise in malicious sites containing "openai" in their name between April 2024 and April 2025

Traffic to threat sites that include the word "travel" spikes between May and June each year.

Common terms used in malicious sites purporting to be legitimate travel sites include "Delta," "Spirit," "beach," "package," and "tour;" the top-trafficked vacation scam sites include the word "Mexico."

On May 8, 2024, traffic to threat sites that include the word "travel" peaked, marking 256% over the average between 2023 to April 2025.

On June 12, 2024, 3.46% of all traffic to domains with "vacation" in their name was blocked, which was the highest-ever percentage.

In 2025, the largest spike in traffic to threat sites with travel terms in their name occurred on April 28, marking a 116% increase over the average since 2023.

Traffic to malicious sites with "travel" in the domain name was 235% higher between May and July 2024 than the overall average between 2023 and April 2025