topic Re: Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances in Spark Firewall (SMB)

Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances

sx8n20394 — Wed, 22 Jul 2026 14:08:08 GMT

We recently started using a 3rd party DNS/Content filtering product with our Checkpoint Spark appliances and noticed that we get floods of Shodan.io lookups in the DNS logs that make up 15% of our DNS traffic. These requests do not show up in our Checkpoint appliance logs. This is across all customer environments so I am positive there is some service running on the Checkpoint that is doing these lookups. I opened a TAC case but they don't seem to know what I'm talking about. Can anyone out there provide some insight or if you noticed this as well?

Re: Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances

Lesley — Wed, 22 Jul 2026 14:13:56 GMT

If you create wireshark / tcpdump you see those requests? Is the Check Point maybe set as DNS server for clients? Maybe it is just forwarding it.

Re: Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances

sx8n20394 — Wed, 22 Jul 2026 14:15:34 GMT

I don't think it is just forwarding it because I setup a 2560 with nothing connected to it in my lab and it still sends the requests.

Re: Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances

Bob_Zimmerman — Wed, 22 Jul 2026 14:29:01 GMT

What do the requests look like? Just asking for the A record?

Do you have a domain object for shodan.io in your configuration? Domain objects with the FQDN box checked cause the firewall to look up the A records for the domain represented by the object.

Re: Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances

Lesley — Thu, 23 Jul 2026 20:25:57 GMT

Would open TAC case with this info with packet captures, if there are no clients why does it try to resolve this.

Also what Bob said you should check.

Re: Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances

_Val_ — Fri, 24 Jul 2026 08:48:24 GMT

Just a thought. If you have HTTPS Inspection enabled, even HTTPS Lite, GW will independently resolve web servers based on the traffic you have filtered.

Re: Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances

PhoneBoy — Mon, 27 Jul 2026 23:08:23 GMT

Found your TAC case when I was researching this 🙂
It seems like this has occurred for some other customers as well, but not sure what ultimately solved it.