Generally, the present invention provides for monitoring user Internet activity based on DNS information. The invention includes accessing a plurality of query logs from a plurality of DNS servers and retrieving a plurality of DNS requests from the query logs. The DNS requests are requests from a various computing devices that have requested web content from web servers indicated by IP addresses. The invention further includes processing the DNS requests to determine Internet-based activity information by the plurality of computing devices that requested the web content and determining attention data based on the activity information. The attention data indicates web search trends based on the corresponding IP addresses accessed by the requesting computing devices.