Datadog source?

Help
1

Hi, I installed today the latest pihole (non-docker, on Ubuntu 24.04) and everything works correctly, anyway i was wondering is pihole connecting to "http-intake.logs.datadoghq.com" for some reason?

I see a lot of those entries and can't fully understand the source client.
The reason is that the requests to pihole come only from two other servers, and looking at those servers logs I can only see that for each of the entries showed in pihole:

  • a first query starts from the pihole server (192.168.1.141)
  • a second query starts from the gateway (192.168.1.254)
17/07/2025 17:31:55 0CF8 PACKET  000001B6XXXXXXXX UDP Snd 192.168.1.141   f7ea   Q [0001   D   NOERROR] A      (11)http-intake(4)logs(9)datadoghq(3)com(0)

17/07/2025 17:31:55 0CF8 PACKET  000001B6YYYYYYYY UDP Snd 192.168.1.254   1891 R Q [8081   DR  NOERROR] A      (11)http-intake(4)logs(9)datadoghq(3)com(0)

Any suggestion about this?

2

No.
Pi-hole code doesn't use this domain.

Maybe something else installed on the same machine is querying the domain.

3

Datadog is a commonly used website analytics provider, and the domains similar to what you listed are present in some adlists, but the variant you have posted seems a little shorter than what is commonly seen. Keep in mind that it may have been deliberately excluded from more conservatively managed blocklists if blocking it causes website breakage).

image
image812×1093 128 KB

You can also block it from the query log, by hitting "Deny"

image
image1182×104 11.4 KB

4

Ok thanks guys, I guess I'll need to dig deeper on this to find the culprit (maybe ubuntu itself?).
I will update if I find it.