ET TROJAN DNS Reply for unallocated address space - Potentially Malicious 1.1.1.0/24

Description:

• An A record has been returned from a DNS query in the 1.1.1.0/24 IP block. Because this space isn't routed, DNS servers should not respond with addresses in the space - see:
• https://www.apnic.net/manage-ip/apnic-services/registration-services/resource-quality-assurance/reserved-ranges
• In practice, this space is occasionally used, usually for temporary installation/configuration or in lab environments.

False Positive:

• YES
• DNS A query against switch.meraki.com does return 1.1.1.100, which matches this space.
• This is not malicious, however. This is defined setup behavior:
  • http://www.virtualizationhowto.com/2016/01/meraki-ms2208p-unboxing-initial-setup/

Action:

• None