Blackhole DNS URLs

[presscotn]

We regularly get BlackHole DNS URL's in our Malware Threat Report (Adware>Blackhole DNS URLs)

The report states that transactions are all blocked.

When we go to examine/scan the user/computer that is referenced and run Malwarebytes scans nothing is detected.

Could you provide some guidance as to

1.) any corrective action that could be taken to eliminate the reported threat.

2.) describe recommended practises when these instances show up in the report

TIA

Thomas

[Ken Stieers]

Its very possible that your users aren't infected at all, it could be a "drive-by attack", which your WSA is protecting you from. If someone surfs to a web site that references one of those sites, the browser will happily go there. Nobody on your network has to be doing anything wrong, but the website may have been compromised.