> Source: [sk74060](https://support.checkpoint.com/results/sk/sk74060) # sk74060 - Anti-Virus Malware DNS Trap feature | Property | Value | |----------|-------| | Solution ID | sk74060 | | Date Created | 2012-05-30 | | Last Modified | 2026-04-13 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Solution Malware DNS Trap identifies compromised clients that try to access known malicious domains. When this feature is enabled, the Security Gateway does not block DNS requests identified as malicious. Instead, the Security Gateway tampers with the DNS response and returns a false (bogus) IP address to the client. Using Malware DNS Trap, you can then detect compromised clients by reviewing logs for connection attempts to the false IP address. Consecutive connections addressed to the bogus IP address are blocked. * When the Security Gateway allows the DNS request, it generates a DNS reputation log with the description "**Connection was allowed because a DNS trap was set** ". * When the Security Gateway tampers with the DNS response, the DNS reputation log description is "**DNS response was replaced with a DNS trap bogus IP** ". * Connections to the bogus IP are logged with the DNS Trap protection type and the description "**Connection to DNS trap bogus IP**". You can set the bogus IP address to be the IP address of the Security Gateway's external interface or another IP address. If you define the Security Gateway's external interface as the bogus IP address, this feature may cause drops of connections addressed to the Security Gateway itself. Therefore, **it is recommended to configure a dedicated bogus IP address and not use the external interface of the Security Gateway**. **Note -** When a client tries to connect to a bogus IP address after receiving a response to the original DNS request, the connection is blocked on the first (SYN) packet. Accordingly, there is nothing to capture. DNS Trap Configuration ---------------------- **In the Anti-Bot and Anti-Virus section of the Security Gateway object:** 1. In SmartConsole, click **Gateways \& Servers** and double-click **Security Gateway** . The Gateway window opens and shows the **General Properties** page. 2. From the navigation tree, select **Anti-Bot and Anti-Virus**. 3. In the **Malicious DNS Trap** section, choose one of the options: * **According to profile settings** - use the Malware DNS Trap IP address configured for each profile. * **IP** - enter the IP address for all the profiles assigned to this Security Gateway: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/AB-R81202301031006281.20.png) The default value for DNS trap IP is 62.0.58.94. If for some reason you cannot use the default IP address 62.0.58.94 as a DNS trap, you can define a specific IP address. At the Security Gateway level, you can use the settings defined for the profiles or a specified IP address that is used by all profiles used on the specific Security Gateway. When you define the Security Gateway's external interface, there is a list of ports for which traffic that is addressed to the Security Gateway is not blocked. You can edit this list in the *$FWDIR/conf/malware_config* file in the*dns_redirection_exceptions* section. ### To set the Malware DNS Trap parameters in the Anti-Bot and Anti-Virus profile: 1. In SmartConsole, go to the **Security Policies**view. 2. In the**Custom Policy Tools** section, click**Profiles.** 3. Edit the relevant Profile and go to**Malware DNS Trap** : ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/SC-R81202301031012282.20.png) ### To create an exception for a specific URL or Domain: 1. Define new Application/Site object. In the Object Explorer, click **New** \> **More** \> **Custom Application/Site** \> **Application/Site**. 2. Select the regular expression checkbox (marked in yellow). 3. Type your Domain/URL (marked in blue). You should define an exception in these three main scenarios: 1. In this example, we define the domain www.ipt.se as an exception. Because this field uses a regular expression, characters such as: !@#$%\^\&\*()_+-=\[\]{}\|;:'\\",.\<\>? which are not part of the regular expression behavior should have the prefix (\\). For example, the period (.) must be written as \\. The dollar sign ($) is a regular expression character and therefore does not require a prefix. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/domain_fixed202401142047011.png) 2. In this example, we define an exception for the URL: www.ipt.se/index.html: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/url_fixed202401142058522.png) 3. In this example, we define an exception for a malicious URL that uses malicious top-level domain: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/domain_and_url_fixed202401142105193.png) 4. Add an exception to the appropriate Threat Prevention rule or to the Global Exceptions as shown in this example. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/Screenshot_1202404301031411.png) 5. ?ake sure all DNS caches are flushed or wait some time before testing again. 6. You should see a log similar to the log below indicating that the defined exception was detected and accepted: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/dns_trap_exception202410101608592.png) For information about how to configure a Malware DNS Trap, refer to the [Threat Prevention Administration Guide](https://support.checkpoint.com/search#q=Threat%20Prevention%20Admin%20Guide&f[commonsource]=C.%20Documentation) of your version. ### Troubleshooting 1. If the above exception does not work, change the Primary Category of the URL object to one of these, and install policy. ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/Screenshot_2202404301036042.png) ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk74060/Screenshot_3202404301036413.png)
2. If the exception still does not work, try changing it to the other above Primary category, and install policy. 3. If the exception still does not work: 1. Change it back to Custom_Application. 2. Install the policy. 3. Change it to Phishing. 4. Install the policy. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content