Infrastructure
What is Sinkhole?
Pointing a formerly malicious domain at a controlled server, which turns the infected machines still calling home into a list.
Sinkholing means taking control of a domain that malware uses, usually through a court order, a registrar or by registering an expired domain, and pointing it at a server run by defenders or researchers.
Infected machines keep calling the domain, so the sinkhole receives a list of victims. It also cuts those machines off from the real operator.