Domain was blocked by dns botnet C&C

can you share the snapshot of the block msg you are seeing

We found the same behavior. Furthermore, we have a FortiAnalyzer connected to our firewall were we also got this alerts of communication with a botnet been block with the following IPs:

23.40.179.27
23.57.90.68
23.61.11.71
23.44.201.234

These detections are weird because some connections are block but not all, as ​@Epitaph91 mention it seems as valid IPs. For example, I have found that the IP 23.44.201.234 corresponds to an Apple Maps application.

last update from support was this…

We are currently generating the new IP Reputation/Anti-Botnet definitions (version 5.023) that removes it from the detection list. This is expected to be released on Tuesday, July 21st at noon PDT and the FortiGuard web portal results will also update accordingly upon its release.

so far after the Botnet IP’s and Domains signatures have been updated we have not seen anymore of the “Domain was blocked by DNS botnet C&C” alerts.