- ELLIO's nine-month reverse DNS study found one record that addresses AI agents, code aimed at log viewers, and 28 fake Googlebots that passed Google's recommended check.
- Automated tools tend to trust text fields such as hostnames, but anyone who controls an address can write them. ELLIO found no proof that any agent acted on the AI-directed record.
- Ask whether AI agents read these fields, whether log viewers escape hostnames, and whether any rule trusts a crawler on its reverse DNS name alone.
A hostname is a claim, not a fact
Security tools and AI assistants often look up the reverse DNS name of an IP address and treat it as harmless background. A new study shows the risk in that habit. The name is only text, and the person who controls an address can sometimes choose it.
ELLIO, a threat research group, tracked reverse DNS data for nine months. It found a handful of names written to be read by software rather than people. This piece draws on ELLIO's report, published October 20. The cases are rare finds in a huge dataset. They do not show a trend.
How the lookup works
A reverse DNS record, called a PTR record, maps an IP address to a name. Log viewers and security tools fetch it to add context to an alert. ELLIO notes that AI assistants enriching an alert also look up reverse DNS.
A common safeguard is forward-confirmed reverse DNS, or FCrDNS. The tool takes the name, looks it up in the other direction, and checks that it leads back to the same address. This shows the two records agree. It does not show the name is honest.
One hostname that addresses an AI agent
ELLIO scanned the PTR data from all 273 days for wording typical of prompt injection, such as "ignore previous instructions" and "system prompt", including spelling variants. Three records matched. Two were ordinary domain names. The third appeared on 8 August on a home connection in the Netherlands.
Read with spaces added, ELLIO says, the name tells an automated agent to ignore all instructions and attack the host that sent the lookup.
The Dutch consumer provider Freedom Internet lets subscribers pick the opening part of their own reverse name. It also publishes the matching forward entry. So the name passes FCrDNS, and it still did when ELLIO checked on 5 October.
ELLIO does not know why the record exists. A joke, an experiment and a trap are all possible. It has no evidence that any agent followed it. Only one PTR in the roughly 1.3 billion addresses ELLIO examined carried such an instruction. ELLIO found no earlier public report of a prompt injection in a PTR record.
A related case sits in network registration data. A Dutch network's name in the RIPE database contains an instruction. ELLIO showed an AI-generated search summary that answered with a poem about an axolotl. ELLIO adds that results vary by language and location.
Code aimed at the log viewer
Reliably Coded B.V. is the Dutch network behind that registry entry. From 26 March, each address in its 194.62.114.0/24 block has carried an HTML payload in its PTR record. The code targets cross-site scripting (XSS), a flaw where an application runs a page's code instead of just showing it.
If a web page displayed the record as live HTML, hovering over the text would send the visitor's browser to s42.re. The operator controls that domain. ELLIO stresses that the record alone does not show any vulnerable application ever ran it.
A second case is more direct. Starting 21 August, one address block held 147 entries containing code rather than hostnames. ELLIO says a log viewer or SIEM that displays such an entry without escaping it could read the page's visible text. It would then send up to 4,000 characters of the encoded result to a server at Gandi. After a further six days, the block also carried shell command injections.
A SIEM is the system where a security team collects and reads its alerts. The hostnames inside those alerts are text that outsiders can write.
Fake Googlebots that passed the check
On a typical day, ELLIO sees about 700 addresses outside Google's networks that claim Googlebot names in reverse DNS. Nearly all fail FCrDNS. Google's verification guide calls that check "sufficient for most use cases".
In June, 28 addresses held by a Russian hosting company got through. The forward lookup of crawl-178-20-236-119.googlebot.com, handled by Google's own DNS, returned a Russian address. A website relying on FCrDNS alone could have treated these visitors as the real Googlebot and skipped its rate limits and bot challenges.
ELLIO reported the problem on 1 June. Google removed the records and awarded ELLIO's team a bug bounty.
Routine change makes the data noisy
ELLIO also measured how much reverse DNS shifts. The median was 14.2 million addresses a day, just over 1 percent of the roughly 1.25 billion with a PTR record. One carrier, Viettel, accounted for 58 percent of changed PTR sets. ELLIO traced this to DNS servers giving inconsistent answers, not to network changes.
For defenders, raw change counts can mislead. Treating each change as new infrastructure can exaggerate activity and hide what deserves attention.
What to ask your team
ELLIO's warning to teams that point AI agents at the internet is that reverse DNS names, service banners and WHOIS records can all be written by an attacker. Agents should not take orders from them. Four questions follow.
First, do any AI agents read reverse DNS, WHOIS or similar fields while triaging alerts? What can they do on their own afterwards?
Second, do your log viewers and SIEM escape hostnames before displaying them?
Third, does any rule trust a crawler because its name passes FCrDNS? Pairing it with a check against the operator's published address ranges is a sensible addition. That suggestion is ours, not ELLIO's.
Fourth, who decides what an automated tool may do without a person's approval?
The pattern to remember: automation extends trust to every field it reads, so any field that outsiders can write should be handled as untrusted input.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ellio.tech.
