topic API or script to report bad URLs to PAN? in General Topics

API or script to report bad URLs to PAN?

Schuyler — Sun, 07 May 2017 17:23:23 GMT

Is there an ability to post bad URL reports to PAN in an automated/scripted fashion?

I know the report site exists (https://urlfiltering.paloaltonetworks.com) but it requires a captcha. My goal is to write a script which takes in a (phishing) URL as input and automatically reports it to several security vendors.

Re: API or script to report bad URLs to PAN?

reaper — Tue, 09 May 2017 13:16:11 GMT

if this is to report malware you can use the WildFire submission API instead: Submit a Website Link to WildFire (API)

you can get your API key by logging into wildfire.paloaltonetworks.com and clicking the 'account' link at the top right

WildFire will go ahead and scan the url you submit, and if malware is found, categorize the URL as malware plus identify whatever malware is found and create signatures for it: 2 birds with 1 stone 😉

Re: API or script to report bad URLs to PAN?

Rags — Tue, 09 May 2017 14:24:10 GMT

I only use the URL form for mis-categorized domains that need changed.

I wouldn't spend any time submitting malicious URLs manually to PAN, they're actually very good at it compared to most vendors I've seen around the web. I would recommend creating a local DBL - Dynamic Block List on your box. When you find a phishing URL, just post it in your block list and move on. PAN probably has to do additional checks on their end before they can issue a malicious category on the domain for all of their customers.

Also, by the time they do that manually, the malicious domain might already be taken down.

Hope that helps, -Rags

Re: API or script to report bad URLs to PAN?

BPry — Tue, 09 May 2017 15:50:23 GMT

@Rags,

This is how I've been doing things and it works very well, you also have the added benefit of making a script so that anybody can report it and your network team doesn't directly need to be involved in any way as long as you trust the rest of your team with confirming it should be blocked.