  Anecdotal evidence suggests an increasing number of people are turning to VPN
services for the properties of privacy, anonymity and free communication over
the internet. Despite this, there is little research into what these services
are actually being used for. We use DNS cache snooping to determine what
domains people are accessing through VPNs. This technique is used to discover
whether certain queries have been made against a particular DNS server. Some
VPNs operate their own DNS servers, ensuring that any cached queries were made
by users of the VPN. We explore 3 methods of DNS cache snooping and briefly
discuss their strengths and limitations. Using the most reliable of the
methods, we perform a DNS cache snooping scan against the DNS servers of
several major VPN providers. With this we discover which domains are actually
accessed through VPNs. We run this technique against popular domains, as well
as those known to be censored in certain countries; China, Indonesia, Iran, and
Turkey. Our work gives a glimpse into what users use VPNs for, and provides a
technique for discovering the frequency with which domain records are accessed
on a DNS server.
