A sinkhole is a defensive server or network endpoint that impersonates a destination that malicious traffic is trying to reach, then redirects that traffic into a controlled environment. Instead of letting infected hosts contact an attacker’s real command-and-control system, the sinkhole absorbs the connection and records useful telemetry such as source IPs, beacon timing, and protocol details.
Sinkholes matter because they help defenders disrupt botnets without needing to seize every infected device at once. They can break the attacker’s visibility, reveal the scale of compromise, and support cleanup by identifying victims. In real operations, sinkholing is often used against malware domains, dead-drop lookups, or fixed command servers. In more layered botnets, a sinkhole may be deployed at one of several lookup or relay points, but it only works well when defenders can predict or intercept the traffic path.