topic Re: DNS requests from gateway for malicious websites in General Topics

DNS requests from gateway for malicious websites

Wolfgang — Mon, 15 Mar 2021 07:23:51 GMT

Dear CheckMates,

sometimes we observed that the gateway does DNS requests to the configured DNS servers for malicious websites.
One of the sites as an example is "www.homng.net".

Why is the gateway trying to get the IP for malicious websites?
Any of the ThreatPrevention feature which does DNS requests sometimes for known malicious websites ?

thanks

Wolfgang

Re: DNS requests from gateway for malicious websites

PhoneBoy — Tue, 16 Mar 2021 20:06:50 GMT

My guess is this is part of SNI verification, which happens even if you’re not doing HTTPS Inspection.
So, relevant for R80.30 JHF and above.

Re: DNS requests from gateway for malicious websites

KostasGR — Tue, 16 Mar 2021 21:20:11 GMT

Hello Wolfgang

Maybe are you using Custom Intelligence Feeds (sk132193)?

BR,
Kostas