Technique
technique:sinkholing
Also: sink holes, sink-hole, sinkhole, sinkholed, sinkholing Rustock
Redirecting malicious domains or infrastructure to controlled sinkhole systems for reporting and disruption.
Redirecting malicious domains or infrastructure to controlled sinkhole systems for reporting and disruption.
“what we did is we sink-holed them with Shadow Server”
Redirecting botnet traffic to infrastructure controlled by defenders to observe victims and disrupt the botnet.
“we pointed it all to our sinkhole”
“when you take the command and control domains away and you point them to your sinkhole”
Redirecting traffic intended for botnet command-and-control addresses to infrastructure controlled by defenders.
“Microsoft made sure to sinkhole Rustock’s main C&C server IP addresses.”
Coordinated redirection or neutralization of malicious domains and botnet infrastructure during takedown operations.
“the coordinated sinkholing of domains was executed”
“They successfully sinkholed the domains”
Redirecting seized malicious domains to infrastructure controlled by Sophos so connection attempts could be observed and logged.
“they wanted to sinkhole the domains”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | Mariposa botnet | Explicit | 94 |
| incoming | USES | Gameover ZeuS | Explicit | 111 |
| incoming | USES | Kernel implant | Derived | 174 |
| incoming | USES | Sophos | Explicit | 174 |
Mariposa botnet INVOLVES sinkholing
The Mariposa Working Group redirected the botnet's command-and-control domains to a sinkhole to observe infected systems and neutralize the botnet.
Explicit Confidence 99% · Chris Davis EP 94 Details
“We went ahead and did that; we pointed it all to our sinkhole”
Gameover ZeuS USES sinkholing
Gameover ZeuS was subjected to coordinated sinkholing attempts, although the attempts did not fully take down the botnet.
Explicit Confidence 88% · Jack Rhysider EP 111 Details
“the coordinated sinkholing of domains was executed, but it did not take down the ZeuS botnet”
Kernel implant USES sinkholing
The implant supported Sophos's broader effort to monitor and investigate malicious infrastructure; the episode separately describes Sophos sinkholing seized domains.
Derived Confidence 68% · Andrew Brandt EP 174 Details
“they wanted to sinkhole the domains and see what was connecting into them”
Sophos USES sinkholing
Sophos used sinkholing after taking control of the malicious update domains to observe connecting systems.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they wanted to sinkhole the domains and see what was connecting into them”