DNS sinkholing

DNS sinkholing is a security technique in which DNS queries for domains used by malware or botnets receive an address chosen by defenders instead of the real one, blocking the connection or diverting it to a server the defenders control. The server or address that absorbs this traffic is called a sinkhole.

Internet service providers, security organizations and corporate network administrators apply it by loading lists of domains to block into their DNS servers. It is used to cut communication between infected devices and command-and-control (C&C) servers, and connection logs collected at the sinkhole help identify infected machines.

This entry is based on AIPOST articles and widely known facts. If something is wrong, please send us a correction request.