Botnet C&C IPDB blocking
FortiGate also maintains a botnet C&C IP address database (botnet IPDB). If a DNS query response IP address
(resolved IP address) matches an entry inside the botnet IPDB, this DNS query is also blocked by DNS Filter botnet C&C blocking.
To view the botnet IPDB list in the CLI:
(global) # diag sys botnet list 9000 10
- proto=TCP ip=103.228.28.166, port=80, rule_id=7630075, name_id=3, hits=0
- proto=TCP ip=5.9.32.166, port=481, rule_id=4146631, name_id=7, hits=0
- proto=TCP ip=91.89.44.166, port=80, rule_id=48, name_id=96, hits=0
- proto=TCP ip=46.211.46.166, port=80, rule_id=48, name_id=96, hits=0
- proto=TCP ip=77.52.52.166, port=80, rule_id=48, name_id=96, hits=0
- proto=TCP ip=98.25.53.166, port=80, rule_id=48, name_id=96, hits=0
- proto=TCP ip=70.120.67.166, port=80, rule_id=48, name_id=96, hits=0
- proto=TCP ip=85.253.77.166, port=80, rule_id=48, name_id=96, hits=0
- proto=TCP ip=193.106.81.166, port=80, rule_id=48, name_id=96, hits=0
- proto=TCP ip=58.13.84.166, port=80, rule_id=48, name_id=96, hits=0
To see an example of how DNS filter botnet C&C IPDB blocking works, select an IP address from the IPDB list and use Internet reverse lookup service to find its corresponding domain name. Then from your internal network PC, use a command line tool such as dig or nslookup to query this domain and see that it’s blocked by DNS Filter botnet C&C blocking. For example:
# dig cpe-98-25-53-166.sc.res.rr.com
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 35135 ;; Flags: qr rd; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 0
;; QUESTION SECTION:
;; cpe-98-25-53-166.sc.res.rr.com. IN A
;; ANSWER SECTION:
cpe-98-25-53-166.sc.res.rr.com. 60 IN A 208.91.112.55 <<<==== Since resolved IP address match the botnet IPDB, dns query blocked with redirect portal IP.
;; Received 64 B
;; Time 2019-04-05 11:06:47 PDT ;; From 172.16.95.16@53(UDP) in 0.6 ms
To check the DNS filter log in the GUI:
- Go to Log & Report > DNS Query to view the DNS query blocked by botnet C&C IPDB blocking.
To check the DNS filter log in the CLI:
1: date=2019-04-05 time=11:06:48 logid=”1501054600″ type=”utm” subtype=”dns” eventtype=”dnsresponse” level=”warning” vd=”vdom1″ eventtime=1554487606 policyid=1 sessionid=55232 srcipp=10.1.100.18 srcport=60510 srcintf=”port10″ srcintfrole=”undefined” dstip=172.16.95.16 dstport=53 dstintf=”port9″ dstintfrole=”undefined” proto=17 profile=”demo” xid=16265 qname=”cpe98-25-53-166.sc.res.rr.com” qtype=”A” qtypeval=1 qclass=”IN” ipaddr=”93.184.216.34″ msgg=”Domain was blocked by dns botnet C&C” action=”redirect” botnetip=98.25.53.166
2: date=2019-04-05 time=11:06:48 logid=”1500054000″ type=”utm” subtype=”dns” eventtype=”dnsquery” level=”information” vd=”vdom1″ eventtime=1554487606 policyid=1 sessionid=55232 srcipp=10.1.100.18 srcport=60510 srcintf=”port10″ srcintfrole=”undefined” dstip=172.16.95.16 dstport=53 dstintf=”port9″ dstintfrole=”undefined” proto=17 profile=”demo” xid=16265 qname=”cpe98-25-53-166.sc.res.rr.com” qtype=”A” qtypeval=1 qclass=”IN”
To check botnet activity:
- Go to Dashboard > Status and see the Botnet Activity widget.
If you cannot find the Botnet Activity widget, click the Settings button at the bottom right, select Add Widget, and add the Botnet Activity widget.