[Analyzer] AdGuard DNS

[mlodic]

Name

AdGuard

Link

https://adguard-dns.io/kb/it/general/dns-providers/

Type of analyzer

this should be used as domain/url analyzer

Why should we use it

We can get DNS resolution + whether the analyzed observable is something that the ADGuard service would block or not

Possible implementation

First analyzer would just be classic dns resolution, without filters: https://unfiltered.adguard-dns.com/dns-query
Second analyzer would be used to detect malicious behavior, use https://dns.adguard-dns.com/dns-query and check for null responses

[g4ze]

hwy! @mlodic , are what should the approach be? do we need to imitate curl "https://unfiltered.adguard-dns.com/dns=example.com" ?

[mlodic]

that's similar to what we do with Quad9 here. If the domain can be resolved with unfiltered requests but the DNS filter filters it, then it means that it's blocked by AdGuard. So 2 DNS queries are required