Figure 3.6： DoTcommunication

3.7 Encrypt DNS Requests to Evade Detection format and encrypting the transmitted data, circumventing the feature detection and themselves are used to store text information related to domain names. There is no mandatory unified standard for their format, and the client can define the parsing logic independently. This flexibility is targeted and abused by malicious program families, and because the traffic is disguised as regular DNs query responses, it has strong A variant of the RapperBot' botnet in 2025is a typical case. It innovatively adopts a and anti-detection by dynamically adjusting the record format. In its early version, the botnet only supported TXT record parsing rules with (< >) as delimiters. Core data such as rules. In subsequent iterations, the attacker switched the delimiter to a vertical bar (l) and way. This dynamic format adjustment strategy can not only prevent the fixed format from being intercepted by the security device's feature library, but also quickly clean up the old version cluster that may be exposed, reducing the risk of traceability. [1]: https://cn-sec.com/archives/1159008.htm