topic Re: Sinkhole Exclusion in General Topics

Sinkhole Exclusion

DonJarmon — Mon, 13 Jun 2022 16:31:14 GMT

This host is flagged as suspicious domain and getting resolved to sinkhole.paloaltonetworks.com. This is a legit host name using for Microsoft certificates. Looking for a way to restore correct resolution.

C:\>nslookup cdp1.public-trust.com

Name: sinkhole.paloaltonetworks.com
Address: 72.5.65.111
Aliases: cdp1.public-trust.com

Thanks

Re: Sinkhole Exclusion

LAYER_8 — Tue, 14 Jun 2022 00:46:09 GMT

Is it possible that all that host traffic is being sinkholed due to quarantine actions?

I checked, indeed that site is categorized as low-risk & computer/internet info, so unless you are explicitly sinkhole-ing low-risk sites, this should not be the case.

Low sev TAC threat case?

Re: Sinkhole Exclusion

DonJarmon — Thu, 16 Jun 2022 04:01:53 GMT

I found the stray entry in an External Dynamic List (EDL) feed and was able to exclude entry until list provider was able to correct.