# Possible malware? strange DNS queries

**URL:** <https://discourse.pi-hole.net/t/possible-malware-strange-dns-queries/7971>\
**Category:** Help\
**Tags:** blacklisting, logs\
**Created:** [March 14, 2018, 2:36pm UTC](https://discourse.pi-hole.net/t/possible-malware-strange-dns-queries/7971 "2018-03-14T14:36:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Comodore125](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/comodore125/32/2800_2.png) [@Comodore125](https://discourse.pi-hole.net/u/Comodore125)\
**Post date:** [March 14, 2018, 2:36pm UTC](https://discourse.pi-hole.net/t/possible-malware-strange-dns-queries/7971/1 "2018-03-14T14:36:43Z")

</div>

My android phone has many queries to this domain:  
`z.moatads.com`

Currently, since my pi-hole is on "steroids" (2,3M blocked domains from many blocklists)  
it is on these three blocklists  
[0]:[https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts](https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts)  
[1]:[http://sysctl.org/cameleon/hosts](http://sysctl.org/cameleon/hosts)  
[5]:[https://hosts-file.net/ad\_servers.txt](https://hosts-file.net/ad_servers.txt)

Problem is that these queries are of unkown origin to me. Is that malware, tracker?  
The fact is that these queries are happening all the time my phone is not used but connected to Wi-Fi.  
I have started tcpdump to my phone, I would like to know more about the traffic around these queries.

On the internet when i google motoadz there are informations about malware. So I am taking this issue very seriously.

Second part:  
Do you guys have some sugestions about tracking this internaly in android OS. Without chance to have this overview we cannot say that android is secure. ...

---

<div class="post-metadata">

**Author:** ![frankrpi3](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/frankrpi3/32/1142_2.png) [@frankrpi3](https://discourse.pi-hole.net/u/frankrpi3)\
**Post date:** [March 14, 2018, 3:12pm UTC](https://discourse.pi-hole.net/t/possible-malware-strange-dns-queries/7971/2 "2018-03-14T15:12:20Z")

</div>

Hi,

you are talking of _z.moatads.com_ !

```
Found in: Cameleon.txt
Found in: EladKarako.txt
Found in: HPHosts-ads.txt
Found in: JoeyLane.txt
Found in: Kowabit.txt
Found in: Mahakala.txt
Found in: HostsFileOrg.txt
Found in: SomeoneWC.txt
Found in: Vokins.txt
Found in: Winhelp2002.txt

```

Nothing really to be afraid of, a little bit GOOGLE leads us to [https://moat.com](https://moat.com)

You can also block tracking when you are not at home using an android ad-blocker!

regards, Frank

---

<div class="post-metadata">

**Author:** ![Comodore125](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/comodore125/32/2800_2.png) [@Comodore125](https://discourse.pi-hole.net/u/Comodore125)\
**Post date:** [March 14, 2018, 3:17pm UTC](https://discourse.pi-hole.net/t/possible-malware-strange-dns-queries/7971/3 "2018-03-14T15:17:26Z")

</div>

I saw things like this [https://community.webroot.com/t5/Introduce-yourself-to-the/What-is-z-moatads-com/td-p/239026](https://community.webroot.com/t5/Introduce-yourself-to-the/What-is-z-moatads-com/td-p/239026) while googling. So that is why I am afraid of that site.

---

<div class="post-metadata">

**Author:** ![Anudeep](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/anudeep/32/194_2.png) [@Anudeep](https://discourse.pi-hole.net/u/Anudeep)\
**Post date:** [March 14, 2018, 3:48pm UTC](https://discourse.pi-hole.net/t/possible-malware-strange-dns-queries/7971/4 "2018-03-14T15:48:54Z")

</div>

I don't think it's a malware, it's just an advert domain. It's related to www.moat.com which is a data analytics site.

It's also mentioned in [Google's third party ad serving companies](https://developers.google.com/third-party-ads/youtube-vendors?visit_id=1-636300226200646639-2928927247&hl=en&rd=1)

---

<div class="post-metadata">

**Author:** ![Comodore125](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/comodore125/32/2800_2.png) [@Comodore125](https://discourse.pi-hole.net/u/Comodore125)\
**Post date:** [March 14, 2018, 4:11pm UTC](https://discourse.pi-hole.net/t/possible-malware-strange-dns-queries/7971/5 "2018-03-14T16:11:02Z")

</div>

Thanks sir. I think you are right.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [June 16, 2018, 11:55pm UTC](https://discourse.pi-hole.net/t/possible-malware-strange-dns-queries/7971/6 "2018-06-16T23:55:55Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.