topic Re: Block High Risk TLDs in Advanced Threat Prevention Discussions

Block High Risk TLDs

Josh990 — Thu, 09 Dec 2021 18:14:37 GMT

Hi All,

I want to start blocking 'high risk' top level domains within PAN-OS. Has anyone else done this successfully?

I presume the following should work based on PAN-OS RegEX:

URL Category:

*.eg/

*.ex/

etc....

Set URL Category to 'Block' within existing URL Filtering Profile.

Cheers

Re: Block High Risk TLDs

OtakarKlier — Fri, 10 Dec 2021 21:30:09 GMT

Hello,

I would say utilize the dynamic features of the PAN to do this for you instead of utilizing specific lists. Enable all, AntiVirus, Anti-Spyware with DNS sinkhole, Vulnerability protection, URL filtering, and wildfire. Then use a secure DNS provider, either palo alto's or someone elses, and block all others. I made a video for a conference regarding secure DNS that is worth the 12 minutes.

https://youtu.be/ROIAYSEbTuo

Its all about defense in depth and machine learning, rather than static lists.

Hope this helps.

Re: Block High Risk TLDs

aobszynski — Mon, 13 Dec 2021 21:07:13 GMT

You can dig more from Unit42 post: https://unit42.paloaltonetworks.com/top-level-domains-cybercrime/
Also, from https://www.spamhaus.org/statistics/tlds/

If you want to do it at larger scale, EDL can be a better choice than static entries.

Re: Block High Risk TLDs

Josh990 — Fri, 28 Jan 2022 10:20:20 GMT

Thanks for the responses all.

I still believe PAN-OS should support blocking specific TLDs in a simple way; this seems like a fool proof way to greatly reduce the attack surface since we never need to visit sites using these TLDs for legitimate reasons.