Recently I'm seeing access attempts by servers belonging to The Shadow Server Foundation to mDNSResponder (via Little Snitch actually). I got access attempts from 184.105.247.199, 184.105.247.227 and 184.105.247.207 (hacking folder)

these domain names under "Websites hosted by The Shadow Server Foundation". Among them a few dubious sounding domain names:

1. malwr.com
2. tvbsp.com
3. foottraffix.com
4. bilescotrej.com
5. make-cash-at-home.com
6. profit-case.com
7. alfa-cash.com
8. milerteddy.com
9. sexy-ladies-wantmeet.com
10. ladies-with-big-tits.com

SECURITY.STACKEXCHANGE.COM

The Shadow Server Foundation constantly trying to get access to mDNSResponder

Update September 2018: The events described below still happen to this day though less often from servers of The Shadow Server Foundation. By now…

NSA ...right here (hacking folder)

Broadnet Portugal
Porto Salvo
TagusPark - Edifício Eastécnica (Porto Salvo),2740-256 Porto Salvo (Oeiras)