topic Re: Completely puzzled - Unique Threat ID: 193986039 in Advanced Threat Prevention Discussions

Completely puzzled - Unique Threat ID: 193986039

Paulo_Henriques — Fri, 09 Mar 2018 17:17:11 GMT

hi,

Did anyone had WildFire Threat events with the following Unique Threat ID: 193986039?

Threat Vault provided me the following information:

Signature Release Domain Name Type

Name: generic:ecompassesfarringdon.com

Unique Threat ID: 193986039

Create Time: 2018-01-18 10:45:23 (UTC)

Threat ID: 4035508

Current Release: 2497 (2018-01-19 UTC)

First Release: 2497 (2018-01-19 UTC)

www threecompassesfarringdon com

AntiVirus

Name: generic:ecompassesfarringdon.com

Unique Threat ID: 193986039

Create Time: 2018-01-18 10:45:23 (UTC)

Threat ID: 3823708

Current Release: 155829 (2018-01-18 UTC)

First Release: 155829 (2018-01-18 UTC)

www threecompassesfarringdon com

WildFire

Being a Tucows domain (Domain Provider with a long story of Nefarious Activity) doesn't help, however the domain appears to be register under Squarespace Inc. which is a legite and known "website creation facilitator" type of company/software.

Re: Completely puzzled - Unique Threat ID: 193986039

OtakarKlier — Fri, 09 Mar 2018 20:22:26 GMT

Hello,

I dont have these on my PAN but dont think anyone in our company would go to that site. I checked a few sites to see if that one was malicious and they came up clean. You could always take some pcaps and have the PAN engineers take a look.

https://www.virustotal.com/en/url/1f0da1753dea79ab135de7a5abf3fd8a31b4446c2347d89300d33bd5355bed00/analysis/

https://quttera.com/sitescan/www.threecompassesfarringdon.com

https://sitecheck.sucuri.net/results/www.threecompassesfarringdon.com

Regards,

Re: Completely puzzled - Unique Threat ID: 193986039

mivaldi — Mon, 12 Mar 2018 17:27:53 GMT

The domain was found to be queried by malicious samples of explorer.exe