https://live.paloaltonetworks.com/t5/advanced-threat-prevention/trying-to-identify-a-threat-by-host-contact-attempts/m-p/456736#M1451 <P>In case anyone comes across this in the future, these lookups were being sourced by a threat intelligence appliance.&nbsp; Why it needs to know about dodgy URLs is clear.&nbsp; Why it tried to resolve them, is not.&nbsp; But at least I got my answer to "what system is originating these queries?".</P> Tue, 04 Jan 2022 16:35:09 GMT swozny 2022-01-04T16:35:09Z https://live.paloaltonetworks.com/t5/advanced-threat-prevention/trying-to-identify-a-threat-by-host-contact-attempts/m-p/455866#M1445 <P>All,</P><P>&nbsp;</P><P>We're trying to track down some weirdness being reported by our Panorama instance.&nbsp; Every night around the same time we see some traffic from our central DNS server get sinkholed because it's a "Suspicious DNS Query".&nbsp; We're working in parallel to identify the system originating these queries, but I was asked to see if anyone in the community recognized a pattern in these hosts and might know if there's a particular piece of malware or botnet we're potentially dealing with.</P><P>&nbsp;</P><P>Any assistance or suggestions would be appreciated.</P><P>&nbsp;</P><P>Thanks,</P><P>&nbsp;</P><P>Scott</P><P>&nbsp;</P><TABLE><TBODY><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P>amazvo.gqhormc.cn</P></TD></TR><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P>sudovenko.com</P></TD></TR><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P>cloudxsolutions.co.uk</P></TD></TR><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P>7585696986757.ru</P></TD></TR><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P><A href="http://www.amazvo.gqhormc.cn" target="_blank">www.amazvo.gqhormc.cn</A></P></TD></TR><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P>novobrbnet.com.logins-longs.tk</P></TD></TR><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P>fiber10.iaasdns.com</P></TD></TR><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P>4eb8fb47d7.nxcli.net</P></TD></TR><TR><TD width="131px"><P>12/28/2021 21:57</P></TD><TD width="378px"><P><A href="http://www.amazvo.gqhormc.cn" target="_blank">www.amazvo.gqhormc.cn</A></P></TD></TR><TR><TD width="131px"><P>12/27/2021 21:57</P></TD><TD width="378px"><P>diiscord-nitro.com</P></TD></TR><TR><TD width="131px"><P>12/26/2021 21:57</P></TD><TD width="378px"><P>161-35-66-173.plesk.page</P></TD></TR><TR><TD width="131px"><P>12/26/2021 21:57</P></TD><TD width="378px"><P>dfscord.com</P></TD></TR><TR><TD width="131px"><P>12/26/2021 21:57</P></TD><TD width="378px"><P>i-selfie.com</P></TD></TR><TR><TD width="131px"><P>12/26/2021 21:57</P></TD><TD width="378px"><P>marmardian.co.vu</P></TD></TR><TR><TD width="131px"><P>12/25/2021 21:57</P></TD><TD width="378px"><P>sleboncoin.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/25/2021 21:57</P></TD><TD width="378px"><P>facebvok.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/25/2021 21:57</P></TD><TD width="378px"><P>paintandgameingfunnny.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/25/2021 21:57</P></TD><TD width="378px"><P>stayhomecornerflash.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/25/2021 21:57</P></TD><TD width="378px"><P><A href="http://www.smbcbc.com" target="_blank">www.smbcbc.com</A></P></TD></TR><TR><TD width="131px"><P>12/25/2021 21:57</P></TD><TD width="378px"><P>amazons.im45.com</P></TD></TR><TR><TD width="131px"><P>12/24/2021 21:57</P></TD><TD width="378px"><P>kurzezeit-sprka-infos-2022.xyz</P></TD></TR><TR><TD width="131px"><P>12/24/2021 21:57</P></TD><TD width="378px"><P>steamcommunlts.ru</P></TD></TR><TR><TD width="131px"><P>12/24/2021 21:57</P></TD><TD width="378px"><P>ruralaccounting.com.au</P></TD></TR><TR><TD width="131px"><P>12/24/2021 21:57</P></TD><TD width="378px"><P>secure6t-verifi.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/24/2021 21:57</P></TD><TD width="378px"><P>reg.chaindaohang.com</P></TD></TR><TR><TD width="131px"><P>12/24/2021 21:57</P></TD><TD width="378px"><P>reg.chaindaohang.com</P></TD></TR><TR><TD width="131px"><P>12/23/2021 21:57</P></TD><TD width="378px"><P>shelivesstore.com</P></TD></TR><TR><TD width="131px"><P>12/23/2021 21:57</P></TD><TD width="378px"><P>ruralaccounting.com.au</P></TD></TR><TR><TD width="131px"><P>12/23/2021 21:57</P></TD><TD width="378px"><P>lnterbanksunat.com</P></TD></TR><TR><TD width="131px"><P>12/23/2021 21:57</P></TD><TD width="378px"><P>dethrone.pe</P></TD></TR><TR><TD width="131px"><P>12/23/2021 21:57</P></TD><TD width="378px"><P>alertpayppusernotice.ru</P></TD></TR><TR><TD width="131px"><P>12/23/2021 21:57</P></TD><TD width="378px"><P>dethrone.pe</P></TD></TR><TR><TD width="131px"><P>12/23/2021 21:57</P></TD><TD width="378px"><P>amazon.co.jp.vjpjjeo.cn</P></TD></TR><TR><TD width="131px"><P>12/22/2021 20:56</P></TD><TD width="378px"><P><A href="http://www.gisunit.com" target="_blank">www.gisunit.com</A></P></TD></TR><TR><TD width="131px"><P>12/22/2021 20:55</P></TD><TD width="378px"><P>amazon.ottre.club</P></TD></TR><TR><TD width="131px"><P>12/22/2021 20:55</P></TD><TD width="378px"><P>reg.chaindaohang.com</P></TD></TR><TR><TD width="131px"><P>12/22/2021 20:55</P></TD><TD width="378px"><P>kzeit-sparka-2022.xyz</P></TD></TR><TR><TD width="131px"><P>12/22/2021 20:55</P></TD><TD width="378px"><P><A href="http://www1.micard.co.jp.tingbnb.com" target="_blank">www1.micard.co.jp.tingbnb.com</A></P></TD></TR><TR><TD width="131px"><P>12/22/2021 20:55</P></TD><TD width="378px"><P>walletconnectverifier.com</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>web-exodus.ru</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P><A href="http://www.paypal.ataier.com" target="_blank">www.paypal.ataier.com</A></P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>web-exodus.ru</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P><A href="http://www.e.aoeosten.com" target="_blank">www.e.aoeosten.com</A></P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>web-exodus.ru</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>discord-gifft.com</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>claimitemffgratis77.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>jegexa8878.temp.swtest.ru</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>identifiez-vous655.yolasite.com</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>identifiez-vous654.yolasite.com</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P>tvenitlix.servehttp.com</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:56</P></TD><TD width="378px"><P><A href="http://www.kddi-south.com" target="_blank">www.kddi-south.com</A></P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:55</P></TD><TD width="378px"><P>donaldrsteele.com</P></TD></TR><TR><TD width="131px"><P>12/21/2021 20:55</P></TD><TD width="378px"><P>opro-abonnement.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/20/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.losingyourbelly.com" target="_blank">www.losingyourbelly.com</A></P></TD></TR><TR><TD width="131px"><P>12/20/2021 20:55</P></TD><TD width="378px"><P>superschool.bytesolutions.tk</P></TD></TR><TR><TD width="131px"><P>12/20/2021 20:55</P></TD><TD width="378px"><P>superschool.bytesolutions.tk</P></TD></TR><TR><TD width="131px"><P>12/20/2021 20:55</P></TD><TD width="378px"><P>https.appcompleto.dynv6.net</P></TD></TR><TR><TD width="131px"><P>12/19/2021 21:57</P></TD><TD width="378px"><P>apoioparaempresas.com</P></TD></TR><TR><TD width="131px"><P>12/19/2021 21:57</P></TD><TD width="378px"><P>martalunghabitats.co.vu</P></TD></TR><TR><TD width="131px"><P>12/19/2021 21:57</P></TD><TD width="378px"><P>efilingtaxes.net</P></TD></TR><TR><TD width="131px"><P>12/19/2021 21:57</P></TD><TD width="378px"><P>efilingtaxes.net</P></TD></TR><TR><TD width="131px"><P>12/19/2021 21:57</P></TD><TD width="378px"><P>negocios-e-financas.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/19/2021 21:57</P></TD><TD width="378px"><P>onlibanks.5k5.ru</P></TD></TR><TR><TD width="131px"><P>12/19/2021 21:57</P></TD><TD width="378px"><P>martalunghabitats.co.vu</P></TD></TR><TR><TD width="131px"><P>12/18/2021 20:56</P></TD><TD width="378px"><P>olx-pl.szybkiodbior-pieniadz.work</P></TD></TR><TR><TD width="131px"><P>12/18/2021 20:55</P></TD><TD width="378px"><P>walletconnectdapps.in</P></TD></TR><TR><TD width="131px"><P>12/17/2021 20:56</P></TD><TD width="378px"><P>a8hd0j5.cn</P></TD></TR><TR><TD width="131px"><P>12/17/2021 20:56</P></TD><TD width="378px"><P>no.bank-id.cc</P></TD></TR><TR><TD width="131px"><P>12/17/2021 20:56</P></TD><TD width="378px"><P>637900.selcdn.ru</P></TD></TR><TR><TD width="131px"><P>12/17/2021 20:56</P></TD><TD width="378px"><P>exondus-lokin.com</P></TD></TR><TR><TD width="131px"><P>12/17/2021 20:56</P></TD><TD width="378px"><P>no.bank-id.cc</P></TD></TR><TR><TD width="131px"><P>12/17/2021 20:56</P></TD><TD width="378px"><P>637900.selcdn.ru</P></TD></TR><TR><TD width="131px"><P>12/17/2021 20:55</P></TD><TD width="378px"><P>spin-garenafreefire.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/17/2021 20:55</P></TD><TD width="378px"><P>allstardeluxecarwash.com</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>infocz2024.temp.swtest.ru</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>municieneguillagobpe.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.matadormeteo.com" target="_blank">www.matadormeteo.com</A></P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>pancakeswap-finence.com</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>tizianocagalli.com</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>infocz2024.temp.swtest.ru</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>paypal-secured-verification.lhr.rocks</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>resgatarpontos.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>paypal-online-2deposits-paymentaccept.tk</P></TD></TR><TR><TD width="131px"><P>12/16/2021 20:55</P></TD><TD width="378px"><P>aflacl.com</P></TD></TR><TR><TD width="131px"><P>12/15/2021 20:55</P></TD><TD width="378px"><P>giftboxsolutions.xyz</P></TD></TR><TR><TD width="131px"><P>12/15/2021 20:55</P></TD><TD width="378px"><P>irs-homepage.serveirc.com</P></TD></TR><TR><TD width="131px"><P>12/15/2021 20:55</P></TD><TD width="378px"><P>mericarir.mnjrw.com</P></TD></TR><TR><TD width="131px"><P>12/15/2021 20:55</P></TD><TD width="378px"><P>mericari.mihmh.com</P></TD></TR><TR><TD width="131px"><P>12/15/2021 20:55</P></TD><TD width="378px"><P>ascom.co.tz</P></TD></TR><TR><TD width="131px"><P>12/14/2021 20:55</P></TD><TD width="378px"><P>amazon.pingro.club</P></TD></TR><TR><TD width="131px"><P>12/14/2021 20:55</P></TD><TD width="378px"><P>irs-homepage.serveirc.com</P></TD></TR><TR><TD width="131px"><P>12/14/2021 20:55</P></TD><TD width="378px"><P>christianfisch489fwk5htsdv8dscek-9ad890.ingress-erytho.e</P></TD></TR><TR><TD width="131px"><P>12/14/2021 20:55</P></TD><TD width="378px"><P>tr.perlinks.xyz</P></TD></TR><TR><TD width="131px"><P>12/14/2021 20:55</P></TD><TD width="378px"><P>teiujmo61.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/14/2021 20:55</P></TD><TD width="378px"><P>r3c0v3r-w4rn1ngp4g3s.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/13/2021 20:55</P></TD><TD width="378px"><P>irs.us-eligible-aid-donations.com</P></TD></TR><TR><TD width="131px"><P>12/13/2021 20:55</P></TD><TD width="378px"><P>aflaci.com</P></TD></TR><TR><TD width="131px"><P>12/12/2021 20:55</P></TD><TD width="378px"><P>smbc-card.com.etlikes.com</P></TD></TR><TR><TD width="131px"><P>12/11/2021 20:55</P></TD><TD width="378px"><P>projet5859.000webhostapp.com</P></TD></TR><TR><TD width="131px"><P>12/11/2021 20:55</P></TD><TD width="378px"><P>summerdayzlawn.com</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P>darkzonesgaming.club</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.user-authorizationxx3109.storz.ma" target="_blank">www.user-authorizationxx3109.storz.ma</A></P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P>protecpageidentityrecovery.ga</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P>cryptonewjob.com</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P>offertomix.com</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P>secureconnects.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P>osa-academy.com</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P>secureconnects.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P>telcom.pe</P></TD></TR><TR><TD width="131px"><P>12/10/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.user-authorizationxx3109.storz.ma" target="_blank">www.user-authorizationxx3109.storz.ma</A></P></TD></TR><TR><TD width="131px"><P>12/9/2021 20:55</P></TD><TD width="378px"><P>web7080.web07.bero-webspace.de</P></TD></TR><TR><TD width="131px"><P>12/9/2021 20:55</P></TD><TD width="378px"><P>mytelstraw.temp.swtest.ru</P></TD></TR><TR><TD width="131px"><P>12/9/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.mo-menthealth.com" target="_blank">www.mo-menthealth.com</A></P></TD></TR><TR><TD width="131px"><P>12/9/2021 20:55</P></TD><TD width="378px"><P>event-gratis-efootball-pes2021.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/8/2021 20:55</P></TD><TD width="378px"><P>offertomix.com</P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P>amoazan.cqxjlp.com</P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P>eqsrwktdvp.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P>reconfirmpageswarningidentityservice.co.vu</P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.vip-pemersatu.2waky.com" target="_blank">www.vip-pemersatu.2waky.com</A></P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.n.accssen.com" target="_blank">www.n.accssen.com</A></P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.m.accssen.com" target="_blank">www.m.accssen.com</A></P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P>offertomix.com</P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P>nextcloud.overland.cl</P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.n.aooescn.com" target="_blank">www.n.aooescn.com</A></P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P>amoazan.cqxjlp.com</P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P>rheincargo.co.in</P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.c.aooescn.com" target="_blank">www.c.aooescn.com</A></P></TD></TR><TR><TD width="131px"><P>12/7/2021 20:55</P></TD><TD width="378px"><P>100000065497484541136-ar.tk</P></TD></TR><TR><TD width="131px"><P>12/6/2021 20:55</P></TD><TD width="378px"><P>elori71.woodworkingidea.net</P></TD></TR><TR><TD width="131px"><P>12/6/2021 20:55</P></TD><TD width="378px"><P>allkku.com</P></TD></TR><TR><TD width="131px"><P>12/6/2021 20:55</P></TD><TD width="378px"><P><A href="http://www1.sdvccsg-dxh.xyz" target="_blank">www1.sdvccsg-dxh.xyz</A></P></TD></TR><TR><TD width="131px"><P>12/6/2021 20:55</P></TD><TD width="378px"><P>bokeptantenadia.duckdns.org</P></TD></TR><TR><TD width="131px"><P>12/6/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.wellsfargo.onlinesysconfirmation.com" target="_blank">www.wellsfargo.onlinesysconfirmation.com</A></P></TD></TR><TR><TD width="131px"><P>12/6/2021 20:55</P></TD><TD width="378px"><P>hido.co.za</P></TD></TR><TR><TD width="131px"><P>12/6/2021 20:55</P></TD><TD width="378px"><P>allkku.com</P></TD></TR><TR><TD width="131px"><P>12/5/2021 20:55</P></TD><TD width="378px"><P>my.ts3card.com.xflsq.com</P></TD></TR><TR><TD width="131px"><P>12/4/2021 20:55</P></TD><TD width="378px"><P>fasdgsdfg.tokyo</P></TD></TR><TR><TD width="131px"><P>12/4/2021 20:55</P></TD><TD width="378px"><P>amaroner.amaroner.xyz</P></TD></TR><TR><TD width="131px"><P>12/4/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.brooksoutlet.me" target="_blank">www.brooksoutlet.me</A></P></TD></TR><TR><TD width="131px"><P>12/3/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.ducommaquinarias.com" target="_blank">www.ducommaquinarias.com</A></P></TD></TR><TR><TD width="131px"><P>12/3/2021 20:55</P></TD><TD width="378px"><P>orgullocentroamericano.com</P></TD></TR><TR><TD width="131px"><P>12/2/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.easyquickcatch.com" target="_blank">www.easyquickcatch.com</A></P></TD></TR><TR><TD width="131px"><P>12/2/2021 20:55</P></TD><TD width="378px"><P>613422.selcdn.ru</P></TD></TR><TR><TD width="131px"><P>12/2/2021 20:55</P></TD><TD width="378px"><P>piebc.cl</P></TD></TR><TR><TD width="131px"><P>12/2/2021 10:16</P></TD><TD width="378px"><P>gateway.smallcase.com</P></TD></TR><TR><TD width="131px"><P>12/1/2021 20:56</P></TD><TD width="378px"><P>my.orgoffres.xyz</P></TD></TR><TR><TD width="131px"><P>12/1/2021 20:56</P></TD><TD width="378px"><P>dri-ve-buil-der.xyz</P></TD></TR><TR><TD width="131px"><P>12/1/2021 20:56</P></TD><TD width="378px"><P>dri-ve-buil-der.xyz</P></TD></TR><TR><TD width="131px"><P>12/1/2021 20:56</P></TD><TD width="378px"><P>monbudri.xyz</P></TD></TR><TR><TD width="131px"><P>12/1/2021 20:55</P></TD><TD width="378px"><P>alibabatrading.jo</P></TD></TR><TR><TD width="131px"><P>12/1/2021 20:55</P></TD><TD width="378px"><P>dri-ve-buil-der.xyz</P></TD></TR><TR><TD width="131px"><P>12/1/2021 20:55</P></TD><TD width="378px"><P>auth.emailauthentication.xyz</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:56</P></TD><TD width="378px"><P>aleugen.xyz</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:56</P></TD><TD width="378px"><P>pasarbta.info</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:56</P></TD><TD width="378px"><P>africansecrets.ca</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P>aleugen.xyz</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P>africansecrets.ca</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.secben.caconcmeoned.com" target="_blank">www.secben.caconcmeoned.com</A></P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.sobson.caecasroed.com" target="_blank">www.sobson.caecasroed.com</A></P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P>sync-opensea.co</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P>demo11.stagingwork.com</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P><A href="http://www.carpetderatique.com" target="_blank">www.carpetderatique.com</A></P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P>registerdrive.xyz</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P>discorde-gift.com</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P>spk-kundendienstleistung.com</P></TD></TR><TR><TD width="131px"><P>11/30/2021 20:55</P></TD><TD width="378px"><P>steamcommunits.com</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>official-bakeryswap.org</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>monbudri.xyz</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>centroasesorelias.com</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>hatawagency.ir</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>centroasesorelias.com</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>wise.internationalonlineinfo.com</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>610220.selcdn.ru</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>sparkasse-kundenvertrag.com</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:56</P></TD><TD width="378px"><P>sparkasse-kundenofferte.com</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:55</P></TD><TD width="378px"><P>sparkasse-kundendienstonline.com</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:55</P></TD><TD width="378px"><P>lilmamasaccs.com</P></TD></TR><TR><TD width="131px"><P>11/29/2021 20:55</P></TD><TD width="378px"><P>grubnew2021.duckdns.org</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:56</P></TD><TD width="378px"><P><A href="http://www.navmeetcargo.com" target="_blank">www.navmeetcargo.com</A></P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:56</P></TD><TD width="378px"><P><A href="http://www.shiftup-eigyousupport.com" target="_blank">www.shiftup-eigyousupport.com</A></P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:56</P></TD><TD width="378px"><P>monbudri.xyz</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:56</P></TD><TD width="378px"><P>spk-kundenzugang.com</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:56</P></TD><TD width="378px"><P>idverify.globalautodoor.com</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:56</P></TD><TD width="378px"><P><A href="http://www.cumis.cuteqip.net" target="_blank">www.cumis.cuteqip.net</A></P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:56</P></TD><TD width="378px"><P>idverify.globalautodoor.com</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:56</P></TD><TD width="378px"><P>idverify.globalautodoor.com</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:55</P></TD><TD width="378px"><P>job-side.com</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:55</P></TD><TD width="378px"><P>topchiangrai.com</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:55</P></TD><TD width="378px"><P>post-ch-de.34224.info</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:55</P></TD><TD width="378px"><P>idverify.globalautodoor.com</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:55</P></TD><TD width="378px"><P>jlpfc.cn</P></TD></TR><TR><TD width="131px"><P>11/28/2021 20:55</P></TD><TD width="378px"><P>mykonnect.fr</P></TD></TR></TBODY></TABLE><P>&nbsp;</P><P>&nbsp;</P> Wed, 29 Dec 2021 17:29:14 GMT https://live.paloaltonetworks.com/t5/advanced-threat-prevention/trying-to-identify-a-threat-by-host-contact-attempts/m-p/455866#M1445 swozny 2021-12-29T17:29:14Z https://live.paloaltonetworks.com/t5/advanced-threat-prevention/trying-to-identify-a-threat-by-host-contact-attempts/m-p/456736#M1451 <P>In case anyone comes across this in the future, these lookups were being sourced by a threat intelligence appliance.&nbsp; Why it needs to know about dodgy URLs is clear.&nbsp; Why it tried to resolve them, is not.&nbsp; But at least I got my answer to "what system is originating these queries?".</P> Tue, 04 Jan 2022 16:35:09 GMT https://live.paloaltonetworks.com/t5/advanced-threat-prevention/trying-to-identify-a-threat-by-host-contact-attempts/m-p/456736#M1451 swozny 2022-01-04T16:35:09Z