Weird DNS queries from svchost.exe (google.com.onion, wildcard…

I’m investigating a DNS-related alert and wanted to check if anyone has seen similar behavior in a Windows environment.

We observed the following DNS queries from a Windows 11 host:

google.com.onion
*google.com
www.goooooooooooooooooooooooooooooooooooooooooooooooooooooooooogle.com
google.com

All of these were generated within the same second by:

svchost.exe
Running as NT AUTHORITY\SYSTEM
Sysmon Event ID 22 (DNS query)

Some key observations:

The .onion query returned NXDOMAIN (DNS_ERROR_RCODE_NAME_ERROR)
No follow-up connections or IP resolution were observed
The behavior looks like a burst of synthetic / malformed queries rather than user activity

This pattern looks very similar to what people have reported on Samsung devices (MobileWIPS DNS probing / spoof detection), but this is a Windows endpoint.

Question:

Has anyone seen similar DNS query patterns from svchost.exe on Windows endpoints?
Could this be:
- DNS Client (Dnscache) behavior?
- Some Windows network validation / spoof detection logic?
- Or triggered indirectly by EDR/XDR tools interacting with DNS?
Any reliable way to map this definitively to a specific service under svchost using logs alone?

At the moment, it looks benign (NXDOMAIN + no connections), but the .onion query is triggering alerts, so trying to confirm before suppressing.

Appreciate any insights.

Impact

No direct impact or exploitation has been observed. The DNS queries returned negative responses and did not lead to network connections or further activity. The behavior appears benign and may be related to internal system or security tool operations rather than malicious activity.

Defensive guidance

The behavior appears benign and may be part of normal system or security tool operations. Security teams should verify the source of the queries using detailed logging and monitoring before suppressing alerts. If alerts are triggered by .onion domain queries, consider tuning detection rules after confirming no malicious activity. No urgent action is necessary based on current information.

Summary

This report describes anomalous DNS queries originating from svchost.exe on a Windows 11 endpoint. The queries include google.com.onion, wildcard domains, and excessively long malformed domain names, all generated within the same second. The queries returned NXDOMAIN responses and did not result in network connections, suggesting no active exploitation. The pattern is reminiscent of DNS spoof detection or probing mechanisms seen on other platforms but is observed here on Windows. The exact cause is undetermined, with hypotheses including Windows DNS client cache behavior, network validation processes, or interactions with endpoint detection and response tools. No known exploits or vulnerabilities are associated with this behavior.

Weird DNS queries from svchost.exe (google.com.onion, wildcard + malformed domains) · anyone seen this on Windows?

Discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

AI analysisMachine-generated, updated 18 Jun 2026, 13:20 UTC

Technical details

References

Community reviews

Related threats