Glossary: Hardening, Firewalls and Intrusion Detection

DNS sinkhole

Also written: sinkhole

A disruption tool that answers lookups for known bad domains with an address the defenders control. Malware calling home reaches the sinkhole instead, and the sinkhole's log shows which machines are infected.