topic Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529) in General Topics

Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

craigmueller — Wed, 16 Jul 2014 21:46:38 GMT

Does anyone have a link to more information regarding this threat ID ?

I have searched PA's support site and the internet, and have had no luck.

Thanks!!

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

hshah — Wed, 16 Jul 2014 21:54:17 GMT

Hi Craig,

Blonde.crazytall.com is a malware site, when a user/spyware tried to do DNS lookup firewall just blocked DNS. Which in turn subsequent conversation. Let me know if this helps.

Please refer following document for more detail on log.

How to Create a Custom Report for Suspicious DNS Queries

Regards,

Hardik Shah

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

craigmueller — Wed, 16 Jul 2014 22:00:43 GMT

Thank you for the quick response.

Unfortunately, I do not fully understand your explanation.

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

pulukas — Wed, 16 Jul 2014 22:00:45 GMT

hshah

Looks like there is an issue with the Test A Site database. I just ran this on the PA research center and it shows clean as computer category.

craigmueller

You should try to back trace the clients making the request for the site. They are likely infected with malware.

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

hshah — Wed, 16 Jul 2014 22:04:17 GMT

Hi Craig,

Firewall has inbuilt mechanism to block DNS request for malicious web sites.

So, lets say any user tries to access malicious website, which can damage network in future. In that case Firewall will block DNS query, so Connection will never be formed and Network is secure.

Moreover administrator get a log, so he can talk to user about malicious access. If user is unaware of such access then his machine is compromised. Let me know if this helps.

steven Bright cloud detects it as malicious, may be we can submit request for PAN-DB to correct category.

Regards,

Hardik Shah

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

cblackmore — Wed, 16 Jul 2014 23:22:12 GMT

hshah -- BrightCloud's categorization is likely incorrect. We've observed the crazytall domains being used to serve ads, which is perfectly legitimate. However, we've also observed malware connecting out to these domains. Thus, we do not categorize the domains as malicious, because they aren't; but we do categorize them as suspicious, because, as Steven Puluka indicated, accessing them may indicate malware on the endpoint.

That said, per Steven's submission to Test A Site, "Computer and Internet Info" probably isn't the best categorization. It's worth requesting a review of that, even if the optimal bucket isn't "Malware."

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

hshah — Wed, 16 Jul 2014 23:27:16 GMT

Hi Cblackmore,

If you think its a legitimate domain, than please submit a URL Category Change request to bright cloud. Follow bellow URL.

URL Categorization Change Request | Webroot BrightCloud

Once Bright cloud updates URL, firewall will no longer thinks it a malware domain and allow this legitimate traffic.

Regards,

Hardik Shah

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

hshah — Wed, 16 Jul 2014 23:29:49 GMT

Hello Craigmueller,

Virustotal thinks it as a malicious website, hence most likely bright cloud will not change category. If virustotal think it as a malware, than there is something wrong with the website. Please follow bellow link.

https://www.virustotal.com/en/domain/blonde.crazytall.com/information/

Regards,

Hardik Shah

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

cblackmore — Thu, 17 Jul 2014 00:25:14 GMT

hshah,

craigmueller's original question was about a DNS signature, not URL Filtering functionality (whether BrightCloud or PAN-DB).
BrightCloud is not a factor in how we generate DNS signatures. Feel free to submit a change request to BrightCloud, but it will not affect our signatures.
VirusTotal does not believe blonde.crazytall.com to be malicious. VirusTotal is simply a data aggregator, and the data it has aggregated shows that of 57 URL scanners, none believe this domain to be malicious.

The DNS signature exists for the reasons I stated earlier.

Re: Suspicious DNS Query (generic:blonde.crazytall.com)(4100529)

craigmueller — Thu, 17 Jul 2014 16:32:01 GMT

I don't think there is a categorization issue.

I was really just interested in more information regarding this threat ID.

If I am understanding everyone, this seems to be for pop-up ads or malware distribution?

If this is posted twice, I apologize. I previously responded, but no longer see it.