Sinkholes are why you see companies register a bunch of weird domain names.
Palo Alto Networks Inc was granted a patent today related to domain sinkholing, and it’s a continuation patent of one that was granted in 2016.
It reminded me of times I’ve seen companies (notably Microsoft) register a bunch of nonsensical domain names. Why would a company register a lot of domains with random digits and letters?
The answer is often that it’s a sinkhole.
A sinkhole redirects or blocks traffic meant for a destination. They are used by the security community to stop botnet traffic, phishing and other bad activity.
There are many ways to create a sinkhole. An ISP can simply divert traffic from the IP address you see in Whois to another. A company (or the government) can also go through the courts to get control of a domain name and then change its nameservers.
Some malware campaigns continually register new domain names as their other names get snuffed out and blocked by security companies. It’s sometimes possible to figure out what the future domain registrations will be, and that’s when you might see a company register a huge list of odd domain names. They know what domains the malware will register next, so the company registers the domains to prevent them from being registered by the bad guys.
A famous example of registering a domain to stop an attack was the domain name iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea(.)com. A person researching the WannaCry ransomware noticed this domain in the malware and registered it. It turns out that registering the domain acted as a killswitch. The malware was programmed to check in on this domain and stop if the domain was registered.
While the WannaCry example isn’t a typical sinkhole, it’s interesting to think about how domain names are used to propagate malware and botnets, and how registering domains can thwart the bad guys.
Source from domainnamewire.com, author ANDREW ALLEMANN
오늘 .COM 도메인을 구매하고 등록하세요
.COM 도메인 가용성을 확인하고, 새 .COM 도메인을 등록하며, 여러 이름을 일괄 검색하거나 기존 .COM 도메인을 NiceNIC으로 이전하세요. 기업, 도메인 투자자, 에이전시, 호스팅 제공자 및 리셀러를 위해 설계되었습니다.
다음 뉴스: Abandoning a domain name can come back to bite you, research shows
