Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Suspicious DNS Requests ... Issued by a Firewall - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Suspicious DNS Requests ... Issued by a Firewall

An anonymous reader contacted us because he noticed DNS requests for malicious domains originating from his Windows machine, even before he opened a browser.

Looking at the provided capture file, I noticed indeed DNS requests for malicious domains, but also for security related domains, like ClamAV. But these DNS requests were not followed by TCP connections.

With more information provided by the reader, I could confirm one of my theories: on his Windows machine, the reader was using a firewall (Privatefirewall) that accepts rules with domain names to allow/block. There were rules designed to block access to the malicious domain names this reader was noticing.

Here I configure it to block (on 32-bit Windows, the firewall hanged on my 64-bit Windows VM):


To establish TCP connections, a destination IP address is needed: hostnames like have to be translated to an IP address before a TCP connection can be established.

Likewise, for a firewall to block TCP connections with rules with hostnames, the firewall has to lookup these hostnames via DNS requests.

This is what this firewall does, soon after user logon.

It's not an indication of malicious activity, but normal behavior of a security tool that has to translate hostnames to IP addresses to be able to do its job.


Didier Stevens
Senior handler
Microsoft MVP


650 Posts
ISC Handler
Sep 23rd 2018

Sign Up for Free or Log In to start participating in the conversation!