Suspicious DNS Query - how to find source computer?

[_slv_]

Hi

Since I upgraded to 5.0.3 from 4.1.10 I started getting such entry in Treat log:

Suspicious DNS Query (Backdoor.rshot:app.pou.me) 4009473 spyware medium drop-all-packets 74

Suspicious DNS Query (Downloader.fik:encyklopedia.eduteka.pl) 4008620 spyware medium drop-all-packets 31

Suspicious DNS Query (generic:stor1173.uploaded.net) 4014899 spyware medium drop-all-packets 26

Bot: Torpig Phone Home DNS request 12657 spyware medium drop-all-packets 276

Suspicious DNS Query (generic:www.tns-counter.ru) 4000032 spyware medium drop-all-packets 40

It's pointing to my two DNS servers for my local networks. I'm almost sure that this isnt a problem with this servers because last week was Eastern Christmas and during this time I never got such traffic. When my users back to work its started again.

Some of user's computers are in the same Zone as this two DNS servers. How in this case catch sources of this traffic?

For other network I will enable strict Tread profile on allow DNS traffic rules, I hope that this will give me information about real sources of this dns requests.

With regards

Slawek

[sbabu]

Hi,

Please find the below document for the same.

DNS Sinkhole Process with Internal DNS Server

Regards,

Sarath

[MMCiobanu]

I have configured DNS sinkole, but it does not sinkhole these DNS requests (torpig):

NameBot: Torpig Phone Home DNS request

ID12657

I believe sinkhole threat IDs can be between 4000000 and 4999999 on paloalto.

I don't know why torpig is not included.