explain TP Log

[D_W]

Hi Mates,

please can someone explain this log entry?

I understand what happened, the client tried to reach a C&C Server "dopla.com.pl" and the CP replaced the DNS entry with the bogus IP.

But why do we see shodan.io URLS in the forensic info on the left side and why is the protection name: "Conficker..."

[G_W_Albrecht]

This is used when a lookup of an IP address is needed: https://community.checkpoint.com/t5/Management/SmartView-and-Custom-Actions/m-p/68563#M10382

[yalmog]

The default behavior of DNS reputation is to return this bogus ip (62.0.58.94) as a reply to bot DNS request (for name "dojo.census.shodan.io"). This (dst) ip is later detected and blocked on the above https traffic.