topic Re: Botnet report full of cloud.typography.com entries in General Topics

Botnet report full of cloud.typography.com entries

holtcg — Fri, 05 Feb 2016 15:40:22 GMT

My weekly botnet report is full of entries like:

"Repeatedly visited (32) the same malicious URL cloud.typography.com/"

I've checked this URL in the database and using the CLI, and it shows as computer-and-internet-info

Several tools I've used to check the site show nothing malicous.

I'm thinking maybe categorization is the wrong place to look.

I feel like this must be some software that we use, downloading fonts because a visit to the site shows that it isn't something people would be casually browsing to.

I'm not sure how to proceed, I hope someone can point me in the right direction.

Thanks for any suggestions!

Chris

Re: Botnet report full of cloud.typography.com entries

Raido_Rattameister — Fri, 05 Feb 2016 16:06:48 GMT

URL Filtering profile.

Settings tab.

Check "Referer"

Then URL log starts showing referer.

Maybe this malicious site was included to some other site your users browse to.

Re: Botnet report full of cloud.typography.com entries

holtcg — Fri, 05 Feb 2016 16:36:42 GMT

One of the fine technicians at PaloAlto sent me this:

Hi Chris

I checked on this URL on my end and I can't find any information pertaining to it being a malware site either. I did find some mentioning of a reclassification request fairly recently so it is very possible that we simply have a caching issue on the firewall.

Simply log into the CLI and issue the command
>clear url-cache url http://cloud.typography.com

This will force the firewall to reach out to the cloud and refresh the verdict on this site.

I'm happy to say, it seems to have done the trick. I'm looking at the traffic logs and the categorization has been corrected!! Yay!

Chris