Sinkholing is a defensive technique that redirects traffic meant for malicious domains or IP addresses to a server controlled by researchers or law enforcement, cutting malware off from its operators.
How sinkholing works
Most malware contacts its command and control server by domain name. If defenders take control of that domain – by registering it first, through cooperation with the registry or with a court order – they can point it to their own “sinkhole” server. Infected machines then connect to the sinkhole instead of the criminals and receive no further commands. Variants include:
- Domain sinkholing – changing the DNS records of seized or pre-registered malicious domains.
- DNS sinkholes inside a company – the internal resolver returns a safe address for known bad domains, as in DNS firewalls and response policy zones.
- IP or BGP sinkholing – rerouting traffic to an address range at network level.
Why sinkholing matters
Sinkholes disrupt botnets and also reveal how many devices are infected and where, because every bot reports to the sinkhole. Researchers use these logs to notify ISPs and victims. Notable cases:
- Conficker (2009) – an industry working group pre-registered the domains the worm generated each day.
- WannaCry (2017) – researcher Marcus Hutchins registered an unregistered domain found in the code, which acted as a kill switch and stopped the ransomware from spreading further.
- Avalanche (2016) – an international law-enforcement operation seized and sinkholed hundreds of thousands of domains used by criminal infrastructure.
Limitations
Malware authors respond with domain generation algorithms, hard-coded IP addresses, peer-to-peer networks and fallback channels. Sinkholing also does not clean infected machines – it only neutralises them until the owners are notified and remove the malware.
