Methods and devices for blocking, detecting, and/or preventing malicious traffic

1. A method, comprising:

storing, by a processor and in a data structure, network addresses of devices hosting a plurality of blacklisted domains and blacklisted domain identifiers corresponding to the plurality of blacklisted domains;

receiving, by the processor, traffic destined for a destination device associated with a destination network address;

determining, by the processor, that the destination network address corresponds to a network address of the network addresses stored in the data structure;

determining, by the processor and based on determining that the destination network address corresponds to the network address, that the network address corresponds to a blacklisted domain identifier of the blacklisted domain identifiers and that a threat level associated with the blacklisted domain identifier satisfies a threshold;

selecting, by the processor, a sinkhole server identifier from a plurality of sinkhole server identifiers associated with the blacklisted domain identifier based on the threat level,

wherein the sinkhole server identifier is selected based on:

geographic proximity to a location of a client device, or

a round-robin scheduling process; and

redirecting, by the processor, the traffic towards a sinkhole server associated with the sinkhole server identifier.

2. The method of claim 1 , wherein selecting the sinkhole server identifier comprises:

executing a geographic proximity algorithm to select the sinkhole server that is closest to the location of the client device.

3. The method of claim 1 , wherein selecting the sinkhole server identifier includes:

identifying a first geographic location corresponding to the client device from which the traffic was received;

identifying a plurality of second geographic locations corresponding to the plurality of sinkhole server identifiers; and

wherein selecting the sinkhole server identifier comprises:

selecting the sinkhole server identifier associated with the sinkhole server that is geographically closest to the first geographic location.

4. The method of claim 1 , wherein selecting the sinkhole server identifier comprises:

load balancing a plurality of sinkhole servers via the round-robin scheduling process when the geographic proximity to the location of the client device may not be determined.

5. The method of claim 1 , further comprising:

determining that a packet source network address satisfies match criteria associated with the plurality of blacklisted domains;

generating a message including the sinkhole server identifier; and

sending the message to a device corresponding to the packet source network address,

wherein the message includes a domain name system (DNS) response having a time-to-live value set to zero.

6. The method of claim 1 , further comprising:

generating DNS requests that include the blacklisted domain identifiers;

sending the DNS requests to a DNS server;

receiving, from the DNS server, responses to the DNS requests,

wherein the responses include the network addresses of devices hosting the plurality of blacklisted domains; and

caching the network addresses included in the responses to the DNS requests.

7. The method of claim 1 , further comprising:

intercepting DNS messages being exchanged between a DNS resolver device and a DNS server device,

wherein the DNS messages include the network addresses of devices hosting the plurality of blacklisted domains; and

caching the network addresses included in the DNS messages.

8. A network device, comprising:

one or more memories; and

one or more processors, communicatively coupled to the one or more memories, configured to:

store, in a data structure, network addresses of devices hosting a plurality of blacklisted domains and blacklisted domain identifiers corresponding to the plurality of blacklisted domains;

receive traffic destined for a destination device associated with a destination network address;

determine, based on determining that the destination network address corresponds to a network address of the network addresses of devices, that the network address corresponds to a blacklisted domain identifier and that a threat level associated with the blacklisted domain identifier satisfies a threshold;

select a sinkhole server identifier from a plurality of sinkhole server identifiers associated with the blacklisted domain identifier that corresponds to the network address based on the threat level,

wherein the sinkhole server identifier is selected based on:

geographic proximity to a location of a client device, or

a round-robin scheduling process; and

redirect the traffic towards a sinkhole server associated with the sinkhole server identifier.

9. The network device of claim 8 , wherein the one or more processors are further to:

establish filters based on the network addresses of devices hosting the plurality of blacklisted domains; and

install the filters on a forwarding component associated with the network device.

10. The network device of claim 8 , wherein the one or more processors are further to:

determine that the traffic corresponds to Hypertext Transport Protocol (HTTP) traffic;

parse a header of HTTP traffic to determine a domain identifier;

compare the domain identifier to the blacklisted domain identifiers stored in the data structure;

determine that the domain identifier corresponds to a blacklisted domain identifier of the blacklisted domain identifiers;

wherein the one or more processors, when selecting the sinkhole server identifier, are to:

select the sinkhole server identifier based on determining that the domain identifier corresponds to the blacklisted domain identifier; and

wherein the one or more processors, when redirecting the traffic towards the sinkhole server, are to:

HTTP redirect the HTTP traffic towards the sinkhole server associated with the sinkhole server identifier.

11. The network device of claim 9 , wherein the one or more processors are further to:

identify a first geographic location corresponding to the client device from which the traffic was received;

identify a plurality of second geographic locations corresponding to the plurality of sinkhole server identifiers; and

wherein the one or more processors, when selecting the sinkhole server identifier, are to:

select the sinkhole server identifier associated with the sinkhole server that is geographically closest to the first geographic location.

12. The network device of claim 8 , wherein the one or more processors are further to:

determine that a packet source network address satisfies match criteria associated with the plurality of blacklisted domains;

generate a message including the sinkhole server identifier; and

send the message to a device corresponding to the packet source network address,

wherein the message includes a domain name system (DNS) response having a time-to-live value set to zero.

13. The network device of claim 8 , wherein the one or more processors are further to:

load balance a plurality of sinkhole servers via the round-robin scheduling process when the geographic proximity to the location of the client device may not be determined.

14. The network device of claim 8 , wherein the one or more processors are further to:

execute a geographic proximity algorithm to select the sinkhole server that is closest to the location of the client device.

15. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

one or more instructions that, when executed by one or more processors, cause the one or more processors to:

receive network addresses of devices hosting a plurality of blacklisted domains and blacklisted domain identifiers corresponding to the plurality of blacklisted domains;

obtain a set of rules,

wherein the set of rules specify match criteria associated with the plurality of blacklisted domains;

receive traffic destined for a destination device associated with a destination network address;

determine that the destination network address corresponds to a network address of the network addresses based on the match criteria;

determine, based on determining that the destination network address corresponds to the network address, that the network address corresponds to a blacklisted domain identifier of the blacklisted domain identifiers and that a threat level associated with the blacklisted domain identifier satisfies a threshold;

select a sinkhole server identifier from a plurality of sinkhole server identifiers associated with the blacklisted domain identifier based on the threat level,

wherein the sinkhole server identifier is selected based on:

geographic proximity to a location of a client device, or

a round-robin scheduling process; and

redirect the traffic towards a sinkhole server associated with the sinkhole server identifier.

16. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

determine that a packet source network address satisfies the match criteria;

generate a message including the sinkhole server identifier; and

send the message to a device corresponding to the packet source network address,

wherein the message includes a domain name system (DNS) response having a time-to-live value set to zero.

17. The non-transitory computer-readable medium of claim 16 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

monitor a count of DNS requests received from a source network address prefix; and

determine a DNS request is associated with an attacker based on the count satisfying the threshold.

18. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

load balance a plurality of sinkhole servers via the round-robin scheduling process when the geographic proximity to the location of the client device may not be determined.

19. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

execute a geographic proximity algorithm to select the sinkhole server that is closest to the location of the client device.

20. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

intercept DNS messages being exchanged between a DNS resolver device and a DNS server device,

wherein the DNS messages include the network addresses of devices hosting the plurality of blacklisted domains; and

cache the network addresses included in the DNS messages.