NextDNS · home network security threats

4 JULY 2026 · window -24h

At a glance

• ⚠ YELLOW — 20 security-category blocks in the last 24h
• Threshold: 0 green · ≥1 block amber · 5+ high-signal blocks red (AI-Driven Threat Detection = noise, amber-only)
• Source: NextDNS Analytics API · profile PA

Why this matters

The security suite (AI threat detection, threat-intel feeds, Google Safe Browsing, cryptojacking, DNS rebinding, IDN homographs, typosquatting, DGA, NRD, parking, CSAM) catches DNS queries that match known-bad indicators. A non-zero count means a device on the home network tried to resolve a domain on a security list — worth investigating which device and which domain to confirm whether the block was protective (great) or a false-positive on legitimate use.

Privacy blocks (ads/trackers/social-media filters) are not counted here — they’re high-volume by design and noise-up the signal.

Security-category breakdown

Top devices in the window

What to do next

1. Open the NextDNS log: https://my.nextdns.io/9bb389/logs
2. Filter to the security category that fired (e.g. Threat Intel Feeds)
3. For each blocked query, identify: which device, which domain, what was running at the time
4. Decision: keep block (real threat caught) · allowlist (false positive) · investigate device (malware/compromised app)

_{Generated by dare_nextdns_audit.py --check security}