Shodan.io DNS Requests Originating from All Checkpoint Spark Appliances

[sx8n20394]

We recently started using a 3rd party DNS/Content filtering product with our Checkpoint Spark appliances and noticed that we get floods of Shodan.io lookups in the DNS logs that make up 15% of our DNS traffic. These requests do not show up in our Checkpoint appliance logs. This is across all customer environments so I am positive there is some service running on the Checkpoint that is doing these lookups. I opened a TAC case but they don't seem to know what I'm talking about. Can anyone out there provide some insight or if you noticed this as well?

[Lesley]

If you create wireshark / tcpdump you see those requests? Is the Check Point maybe set as DNS server for clients? Maybe it is just forwarding it. 

[sx8n20394]

I don't think it is just forwarding it because I setup a 2560 with nothing connected to it in my lab and it still sends the requests.

[Lesley]

Would open TAC case with this info with packet captures, if there are no clients why does it try to resolve this. 

Also what Bob said you should check. 

[Bob_Zimmerman]

What do the requests look like? Just asking for the A record?

Do you have a domain object for shodan.io in your configuration? Domain objects with the FQDN box checked cause the firewall to look up the A records for the domain represented by the object.

[_Val_]

Just a thought. If you have HTTPS Inspection enabled, even HTTPS Lite, GW will independently resolve web servers based on the traffic you have filtered. 

[PhoneBoy]

Found your TAC case when I was researching this 🙂
It seems like this has occurred for some other customers as well, but not sure what ultimately solved it.