The DNS-BH project creates and maintains a listing of domains that are known to be used to propagate malware and spyware. This project creates the Bind and Windows zone files required to serve fake replies to localhost for any requests to these, thus preventing many spyware installs and reporting.
Managed Detection and Response
A single solution will never catch all spyware and malware. A layered, defense-in-depth approach is needed. This includes antivirus/antispyware protection, proxy servers, domain blocking via blackhole-DNS, and blocking by IP addresses and netblock. Blocking by IP address or netblock is a compliment to any domain or url-based blocklist
Security Operations & Incident Response
For example when seed data pulled from Malware Domains is correlated with passive DNS and ASN data, then visualized, it is possible to see how the majority of the authoritative nameservers are hosted in the same network block. This dependence indicates an investment by the aggressor into a particular hosting company and can provide an effective network-level block at relatively low cost. As always, be aware of potential collateral damage when blocking a network portion that may also contain legitimate IP hosting space.
