Honey pot recommendation for DNS sink holing

[idelconsulting]

Dear all,

we are seeing many DNS alerts for spyware, but we don't have any DNS logs.

Also, internal hosts can't resolve external FQDNs, so probably most of the requests are coming from the proxy.

So we are thinking about setting up DNS sink holing with a honey pot.

Any recommendations what to use as a honey pot so that we can get the most information possible from the client connecting to it?

Thanks and Regards,

   Andreas

[Buck_Smooth]

Not a honeypot but Pi-Hole is what I use for both DNS sinkhole and primary DNS server in some cases.  I run it in VMware on CentOS8 or on a Raspberry Pi.

[OtakarKlier]

Hello,

DNS logs are a big deal. Have you looked into the following article to ensure sinkhole setup correctly and logging correctly:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGECA0

Also I recommend using a secure DNS resolver for anything external.

Here is a link to a video I made for a conference about DNS:

https://youtu.be/ROIAYSEbTuo

Regards,