Expanded Sinkhole Coverage: Two-Thirds More Protection for Your Network

Threat actors never stand still and neither do we. Our Security, Intelligence, and Research team just boosted the number of sinkhole indicators in ThreatSTOP’s threat intelligence by over sixty-six percent. Both IP and domain targets for Sinkholes now enjoy deeper, broader coverage across every ThreatSTOP platform — DNS Defense Cloud, DNS Defense, and IP Defense. The result is clearer visibility into compromise, faster containment, and stronger protection for every device that relies on your network.

What exactly is a sinkhole?

A sinkhole is an IP address or domain name that security researchers or law-enforcement agencies have created or sometimes requisitioned from criminals. Instead of resolving to a live command-and-control server, the traffic lands in a controlled environment where bad behavior is safely observed or null-routed.

When an endpoint on your network reaches out to a sinkhole, it is waving a red flag: “I was or still am infected.” Catching that traffic lets you:

• Identify compromised hosts before data theft or ransomware detonation.

• Map out lateral movement or botnet scale.

• Confirm remediation actually worked when the queries disappear.

Why sinkhole alerts matter

• Early warning – Malware often phones home minutes after execution. An immediate block and alert keeps the threat from escalating.

• Silent infections – Many commodity trojans, loaders, or adware kits talk to sinkholes long after an original takedown. They lurk quietly until they fetch a fresh payload.

• Compliance and incident response – Demonstrating that you detect and act on beaconing traffic satisfies auditors and accelerates post-incident forensics.

How ThreatSTOP turns sinkhole intelligence into active protection

Behind the scenes, our Security, Intelligence, and Research team analyzes global telemetry, takedown notices, and law-enforcement feeds to curate sinkhole indicators alongside protections for command and control, invalid traffic, peer-to-peer abuse, data exfiltration, phishing, SPAM, DDoS activity, and more. Updates flow automatically to every customer, so today’s two-thirds expansion is already working on your behalf.

The two targets you'll want to verify in your policy are:

• TS Curated - Sinkholes - IPs
• TS Curated - Sinkholes - Domains

These are both included in the Command and Control Bundle, customers using the new Command and Control bundle don't have to do anything to receive this new detection.  Our platform already took care of that for you,

Ready to see the difference?

For those interested in joining the ThreatSTOP family, or to learn more about our proactive protections for all environments, we invite you to visit our product page. Discover how our solutions can make a significant difference in your digital security landscape. We have pricing for all sizes of customers. Get started with a Demo today!

Connect with Customers, Disconnect from Risks

MITRE ATT&CK Coverage Matrix