Protection against malicious attacks

There provided a method, including executing on a processor the steps of: monitoring DNS related network traffic including domain name-to-IP key value pairs, monitoring at least such non-DNS related network traffic that is targeting routable IP addresses, determining whether the monitored non-DNS related network traffic is related to a domain name, in the event that the monitored non-DNS related network traffic is determined to be related to a domain name, searching the monitored DNS related network traffic for a matching domain name, in the event that the matching domain name is found in the search, determining whether IP addresses related to the matching domain names also match, and in the event that the IP addresses related to the matching domain names do not match, determining that an internal name-to-IP resolution from a local configuration file is used for the domain name and triggering an alert.