Patent ID: 11895116
Assignee: JUNIPER NETWORKS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
receive network addresses of devices hosting a plurality of blacklisted domains and blacklisted domain identifiers corresponding to the plurality of blacklisted domains;
obtain a set of rules,
wherein the set of rules specify match criteria associated with the plurality of blacklisted domains;

receive traffic destined for a destination device associated with a destination network address;
determine that the destination network address corresponds to a network address of the network addresses based on the match criteria;
determine, based on determining that the destination network address corresponds to the network address, that the network address corresponds to a blacklisted domain identifier of the blacklisted domain identifiers and that a threat level associated with the blacklisted domain identifier satisfies a threshold;
select a sinkhole server identifier from a plurality of sinkhole server identifiers associated with the blacklisted domain identifier based on the threat level,
wherein the sinkhole server identifier is selected based on:
geographic proximity to a location of a client device, or
a round-robin scheduling process; and

redirect the traffic towards a sinkhole server associated with the sinkhole server identifier.