Sinkhole.

What is a sinkhole?

A sinkhole is a way of redirecting network traffic. A US Department of Justice seizure affidavit describes it as the redirection of network traffic, which is typically malicious in nature, from its original destination to a new destination where its malicious function will instead have a harmless or limited effect. Network traffic here means the data that computers send to each other over a network.

How does a sinkhole work?

The affidavit says the technique is most commonly used by cybersecurity researchers to redirect infected computers in a botnet to specified research machines to capture data about them. A botnet is a group of infected computers under common control. The affidavit also explains how domain names work. A domain name is the readable address, and an IP address is the number that identifies a computer. The person or business that registers a domain name is called a registrant, and registrants control the IP address, and thus the computer, to which their domain name resolves. A registrant may therefore move a domain name to another computer. Changing where a domain name points is the kind of change that makes it possible to redirect traffic.

How do law enforcement operations use it?

The affidavit says the technique is also occasionally used in conjunction with law enforcement operations to take control of infected victim computers in a botnet away from cyber criminals.

Why does it matter?

According to the affidavit, the aims of the technique are to capture data about infected computers and, in some operations, to take control of them away from criminals. In both cases the traffic ends up on a machine chosen by the party doing the sinkholing, not by the criminals.

Is a sinkhole the same as a honeypot?

Not as the affidavit describes it. A sinkhole is a redirection of traffic that was heading somewhere else. A honeypot is generally understood as a decoy system, which is a different idea.

Is a sinkhole the same as blocking a domain?

Not exactly. Blocking stops traffic, while a sinkhole sends the traffic to a different destination, as the affidavit describes.

Sources

• US Department of Justice: Affidavit para h: sinkhole is redirection of malicious network traffic to a destination where effect is harmless or limited; used by researchers to redirect botnet….
• CISA: CISA countermeasure CM0011: DNS sinkholes redirect clients trying to reach a malicious domain to a benign destination, which blocks adversary command and control.