By adding the domains to the firewall there is an extra layer of security. Computers that use the sinkhole fail to access the real site. The initial dropper added entries in the local system’s host file so that the malware could always reach its command-and-control servers - even if you black holed them in your DNS. A DNS sinkhole, also known as a sinkhole server, Internet sinkhole, or Blackhole DNS 1 is a DNS server that has been configured to hand out non-routable addresses for a certain set of domain names.

I implemented it after noticing that some of the newer malware had cottoned on to the whole DNS black hole idea. The other major use is to add the list to your firewall in my case ISA Server 2006. If you get creative you might consider routing them to a honeypot machine on your network that will detect attempts to connect to the domains on the list. The most popular approach is to route the domains to 127.0.0.1 or ::1. The idea is to add the list of malware domains to your DNS server and route them somewhere other than where they are intended. DNS sinkholing can be used to prevent access to malicious URLs at an enterprise level. This can be achieved by configuring the DNS forwarder to return a false IP address to a specific URL. It is up to you to figure out how you want to integrate it into your network. DNS sinkhole or black hole DNS is used to spoof DNS servers to prevent resolving hostnames of specified URLs. I prefer, who provide a list of domains known to host malware. There are many approaches to implementing a DNS black hole.

Dns blackhole