bot prevention log meaning

[Sagar_Manandhar]

hi,

What kind of bot event is this, where destination is its own default DNS trap default IP ? 

[Benjamin_Hofst1 · Accepted solution]

A Check Point Firewall saw a DNS Request namesvrtwo.serveftp.com. The Check Point Firewall answered the (suspicious) DNS Request with the default DNS Trap IP. If you have an internal DNS Server, the Firewall cannot see or log the original Requester (the Client with a possible Bot) because the DNS Request comes form the internal DNS.

Then the client is sending a Request do namesvrtwo.serveftp.com (Resolved to the DNS Trap IP). This way you can find the Client infected by the Bot.