TopicCybersecurity →
Simple definition
DNS sinkhole is a concept or mechanism used in cybersecurity to redirigate some malicious domains to a controlled target.
Technical definition
In a business environment, DNS sinkhole mainly intervenes to redirigate some malicious domains to a controlled target. Its implementation depends on the architecture, equipment and security policies in place.
What is it used for?
redirigate some malicious domains to a controlled target.
Practical example
one firewall blocks a command and control domain by returning an address from,288.
Common issues
- false positive
- obsolete list
- DoH bypass
Key takeaway: Always adapt the diagnosis to the product version and the architecture actually deployed.