What it detects
A DNS response arriving without a query.
Why it fires
Possible DNS cache poisoning, spoofing or reflection signal.
Worst case
Cache poisoning · reflection
Matching signatures
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.