what look like DGA queries from pfSense

[deanfourie]

Im seeing a lot of strange DNS queries such as

iqnoevfvxi.domain.com

There can be anywhere from 10 to 100 of them and they appear to be coming from pfSense.

Any ideas what this could be?

[johnpoz]

@deanfourie said in what look like DGA queries from pfSense:

Any ideas what this could be?

A client asking for it.. Or you loading a list from that domain, say pfblocker.

The only thing pfsense would query for really on its own is to check if there is an update available or your package list.