In some implementations, a method includes logging, by a user device, mapping data that maps domain names of Internet resources presented on the user device to Internet Protocol (IP) addresses of the Internet resources, determining, by the user device, that one or more criteria are satisfied for transmitting the mapping data to a passive Domain Name Service (DNS) system, and in response to determining that the one or more criteria are satisfied, transmitting, by the user device, the mapping data to the passive DNS system.