malicious domain

[simsim]

Hi,

What is the benefit if we use sinkhole instead of just blocking malicious domain resolving

Thanks

[tac.in]

Hi Simsim,
If the malicious URL is resolved in to an ipaddress , session might be created and your public IP might get blacklisted

[simsim]

Hi,

There are two options 

1) block (default )

2) sinkhole 

My question is why we don't we go for block instead of sinkhole 

Thanks

[tac.in]

if u block the URL will be blocked ( but resolve to an IP address)

sinkhole - will resolve to the specified address.

[reaper · Accepted solution]

block will simply block the connection, end of story

sinkhole will feed the client a false IP address which can help track which hosts are infected:

Because malicious DNS requests will typically come from the company bind/ActiveDir DNS server instead of the clients directly you will not know which client is requesting malicious domain info

with sinkhole, the infected client will try to connect to the sinkhole IP and you'll know exactly which clients are infected

[Raido_Rattameister]

As @reaper mentioned it is good to identify infected client.

If your environment is set up correctly and traffic from clients to servers passes through firewall then you can identify client even with block activity.

But too many environments have clients and DNS in same zone so firewall sees only requests sent by DNS server but not clients.