A few workstations have been making dns requests to what looks to be DGA domains and talked to the security appliance vendor with little help. A vendor technician told me that some Apple servers responsible for a sanity check might look like DGA domains and also, it might have been related advertisement sites.

If the endpoint devices turned out clean with no malware or bot installed, what potential reason would be there for those certain devices to make weird dns requests and what would be the best way to stop them?

  • You don't provide any specific details about what you consider weird requests. Therefore it is impossible to say what is actually going on, i.e. if it might be malware or it might be request one can see from Chrome or similar. And because of this lack of information it is also impossible to recommend what to do. – Steffen Ullrich May 16 at 6:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.