topic Re: malicious domain in General Topics

malicious domain

simsim — Mon, 15 May 2017 10:06:18 GMT

Hi,

What is the benefit if we use sinkhole instead of just blocking malicious domain resolving

Thanks

Re: malicious domain

tac.in — Mon, 15 May 2017 14:13:53 GMT

Hi Simsim,
If the malicious URL is resolved in to an ipaddress , session might be created and your public IP might get blacklisted

Re: malicious domain

simsim — Mon, 15 May 2017 15:27:08 GMT

Hi,

There are two options

1) block (default )

2) sinkhole

My question is why we don't we go for block instead of sinkhole

Thanks

Re: malicious domain

tac.in — Tue, 16 May 2017 06:52:33 GMT

if u block the URL will be blocked ( but resolve to an IP address)

sinkhole - will resolve to the specified address.

Re: malicious domain

reaper — Tue, 16 May 2017 10:15:31 GMT

block will simply block the connection, end of story

sinkhole will feed the client a false IP address which can help track which hosts are infected:

Because malicious DNS requests will typically come from the company bind/ActiveDir DNS server instead of the clients directly you will not know which client is requesting malicious domain info

with sinkhole, the infected client will try to connect to the sinkhole IP and you'll know exactly which clients are infected

Re: malicious domain

Raido_Rattameister — Tue, 16 May 2017 11:48:50 GMT

As @reaper mentioned it is good to identify infected client.

If your environment is set up correctly and traffic from clients to servers passes through firewall then you can identify client even with block activity.

But too many environments have clients and DNS in same zone so firewall sees only requests sent by DNS server but not clients.