NF – Bad TLD domain – site DNS query – Check domains
This alert is triggered when a DNS query is made from the home network to an external network for a domain ending with ".site"
ID Number
5017865
Signature
alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"NF - Bad TLD domain - site DNS query - Check domains"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|site|00|"; fast_pattern; nocase; distance:0; reference:url,networkforensic.dk; metadata:14032020; classtype:bad-unknown; sid:5017865; rev:1;)
Severity
Low
Recommendations/Investigative actions
Determine if access to .site domains is expected and necessary for your organization.
If the query is not legitimate, investigate the source of the query to determine what caused it.
If there is no business requirement for accessing .site domains, implement blocks or restrictions to mitigate potential security risks.