Sinkhole

---

In cyber security terminology, a sinkhole is the location directed to when a device attempts to access a domain but is instead directed to a location which was not the intended target. This typically occurs when malware attempts to connect to a command and control centre, but the connection is instead made to a benign location owned by a security organisation. This can happen either because the security organisation has acquired the domain, or a DNS server is configured to direct known malicious traffic to a benign location (called DNS sinkholing ).

Types of Sinkhole

Sinkholed Malicious Domains

Security companies and independent researchers acquire domains which have previously been used, are actively used, or are expected to be used in the future by malware. The benign location the malware then directs to is referred to as a sinkhole.

One example case of security companies acquiring known malicious domains is the sinkholing of domains associated with the Conficker worm . Each variant of the malware randomly generated domain names in a process known as domain fluxing . Security organisations made efforts to sinkhole all domains used by the worm, in order to prevent it being able to successfully update.

DNS Sinkhole

Main article: DNS sinkhole

A DNS sinkhole, also known as a sinkhole server, Internet sinkhole, or Blackhole DNS is a DNS server that gives out false information, to prevent the use of a domain name.

Sinkhole (in cyber security)

This article "Sinkhole" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Sinkhole. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.

This page exists already on Wikipedia.

---