Methods and devices for blocking, detecting, and/or preventing malicious traffic

A network device, comprising:

• one or more memories;
• and
• one or more processors, communicatively coupled to the one or more memories, configured to:
• store, in a data structure, network addresses of devices hosting a plurality of blacklisted domains and blacklisted domain identifiers corresponding to the plurality of blacklisted domains;
• receive traffic destined for a destination device associated with a destination network address;
• determine, based on determining that the destination network address corresponds to a network address of the network addresses of devices, that the network address corresponds to a blacklisted domain identifier and that a threat level associated with the blacklisted domain identifier satisfies a threshold;
• select a sinkhole server identifier from a plurality of sinkhole server identifiers associated with the blacklisted domain identifier that corresponds to the network address based on the threat level,
• wherein the sinkhole server identifier is selected based on:
• geographic proximity to a location of a client device, or
• a round-robin scheduling process;
• and
• redirect the traffic towards a sinkhole server associated with the sinkhole server identifier.

A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive network addresses of devices hosting a plurality of blacklisted domains and blacklisted domain identifiers corresponding to the plurality of blacklisted domains;
• obtain a set of rules,
• wherein the set of rules specify match criteria associated with the plurality of blacklisted domains;
• receive traffic destined for a destination device associated with a destination network address;
• determine that the destination network address corresponds to a network address of the network addresses based on the match criteria;
• determine, based on determining that the destination network address corresponds to the network address, that the network address corresponds to a blacklisted domain identifier of the blacklisted domain identifiers and that a threat level associated with the blacklisted domain identifier satisfies a threshold;
• select a sinkhole server identifier from a plurality of sinkhole server identifiers associated with the blacklisted domain identifier based on the threat level,
• wherein the sinkhole server identifier is selected based on:
• geographic proximity to a location of a client device, or
• a round-robin scheduling process;
• and
• redirect the traffic towards a sinkhole server associated with the sinkhole server identifier.