Malware Hash Registry DNS requests failing

[nb40]

I've noticed a high volume of failed DNS requests to coming from our Security Onion (SO) instance. It looks like SO is trying to check file hashes using the malwarehashregistry analyzer, but the DNS queries are failing.
According to the documentation from Cymru, requests should be directed to —not . However, when I inspect the analyzer files in SO, I don’t see any reference to , so I’m unsure where this request is originating from.
Any guidance on where else I should look, or why SO might be attempting to reach that specific domain, would be greatly appreciated