topic DNS query to problematic web site in General Topics

DNS query to problematic web site

samhk — Fri, 22 Jun 2018 09:48:17 GMT

PA itself was generated the DNS queue of the domain that the management interface

Why would it come up with this action, and DNS proxy do not enabled.

Please kindly advise.

Log:
This host was detected performing a DNS lookup for the domain en[dot]wt1[dot]pw. Although no traffic was detected with the IP behind this domain, this domain is used to buy and sell credit card numbers, bank accounts, and other similar content.

Re: DNS query to problematic web site

LukeBullimore — Fri, 22 Jun 2018 13:20:34 GMT

Hi,

If I understood your question correctly:

You will see DNS traffic come from the management interface when the firewall needs to refresh FQDN objects. There is also a correlating log for this that is shown as "dnsproxy" even if DNS proxy is not configured.

Hope this answers your question.

Thanks,

Luke.

Re: DNS query to problematic web site

samhk — Mon, 25 Jun 2018 01:41:11 GMT

HI,

The PA try to DNS lookup for the domain en[dot]wt1[dot]pw. But I do not see this domain en[dot]wt1[dot]pw on FQDN qbject.

Is it possible that PA would check some problematic domain that not in FQDN also?

Thanks

Sam