INDICATOR-COMPROMISE Suspicious .tk dns query

I've seen the same thing as Edmund.

The link to SNORT is not valid at the time of this posting - returns no results for 39867.

Is this a valid alert still?

Same issue here. It's blocking requests made by my anti-spam system to a blacklist provider.

Is there a way to OK DNS requests to a single domain and leave the rest of the system as is?

Same issue here. It's blocking requests made by my anti-spam system to a blacklist provider.

Is there a way to OK DNS requests to a single domain and leave the rest of the system as is?

you could try to edit this file:

/etc/snort/rules/astaro.rules

Remove this line:

drop udp $HOME_NET any -> any 53 (msg:"D INDICATOR-COMPROMISE Suspicious .tk dns query " group="241"; flow:to_server; byte_test:1,!&,0xF8,2; content:"|02|tk|00|"; fast_pattern:only; metadata:policy security-ips drop, service dns; classtype:trojan-activity; sid:39867;)

I don't know how long this lasts, probably until next pattern update...

I am encountering this as well.  My anti-spam appliance is being blocked from some DNS lookups of potentially malicious domains, specifically those ending in .tk.  I'm trying to come up with a way to allow the traffic, without disabling too many features in the IPS module.  Of course the question is, do I even want to allow my anti-spam appliance doing DNS lookups of potentially malicious sites?  Nevertheless, here is what I came up with.  Anyone know if this would work?

Under Network Protection > Intrusion Prevention > Exceptions

Create a New Exceptions List with the following settings:

Skip These Checks: Intrusion Prevention

For All Request Coming From: Anti-Spam Appliance

And Using These Services: DNS

Regards,

That should do what you want.

Here's a nifty trick that others can use to block all DNS inquiries to the .tk TLD: Block a TLD

Cheers - Bob

Hello Bob, I am having the same issue with the .tk domain that keeps triggering the IPS. On your nifty trick, do I just use the IP address triggered by the IPS or is there a way to block the domain itself? I already have a DNAT in place to block IP addresses but I feel its not working. You seem to be the go-to-guy in all the forums I read and your thoughts have really helped me.

Thanks

Gino.

Hi, Gino, and welcome to the UTM Community!

Thanks for the vote of confidence!

Just follow the link in my post above to which you replied.  That effectively blocks the entire domain.  The IP in the Network definition is a dummy one, so no lookups can be made for the top level domain.  Just replace "ru" with "tk" in the definition.  If you also want to block ru, then just add tk to 'Additional Hostnames'.

Cheers - Bob