topic Re: New URL filtering category/feature for new domains (less then 24hr) in General Topics

New URL filtering category/feature for new domains (less then 24hr)

Gun-Slinger — Tue, 16 May 2017 19:17:58 GMT

Please vote if you see this useful.

This would enable a category that would scope domains deployed with a life-time less then 24hrs.

Block new Domains created under 24 hour Block new Domains created under 24 hours old
FR ID: 7321

Re: New URL filtering category/feature for new domains (less then 24hr)

Remo — Tue, 16 May 2017 19:45:12 GMT

Wouldn't it make more sense if you simply block category "unknown", or if a block is not possible it you could use "continue" (this way at least malware is prevented from communicating)?

To be honest, this FR seams to be old, really, really old because of the low ID, so the chances for this FR are pretty low

Re: New URL filtering category/feature for new domains (less then 24hr)

BPry — Tue, 16 May 2017 20:54:02 GMT

@Remo,

The request seems to be gaining popularity recently, but you're right we have other ways of getting around this so the likelihood of this gaining enough votes to be implemented is unlikely.

Re: New URL filtering category/feature for new domains (less then 24hr)

Brandon_Wertz — Wed, 17 May 2017 12:57:27 GMT

I agree with @Remo Seems really burdensome to have to track, catalog, and account for the age of a new domain. Only to have it moved to an already existing category (Unknown) after 24 hours.

Maybe a better way would be to try to enhance PAN-DB's or Brightcloud's "live/on the spot" categorization functionality?

Re: New URL filtering category/feature for new domains (less then 24hr)

Gun-Slinger — Wed, 24 May 2017 13:48:42 GMT

This was just implemented according to my SE.

Re: New URL filtering category/feature for new domains (less then 24hr)

Gun-Slinger — Wed, 24 May 2017 13:58:22 GMT

The unknown catagory: The website has not yet been categorized, so it does not exist in the URL filtering database on the firewall or in the URL cloud database.

This covers a percentage of what would fall under the <24/48 life span window of a new domain, however you still run the issue of it just being a domain that hasn't been injected in the URL DB but could have been online for sometime.

Also we are really interested in the "Last registared date" not the original. This should be an easy implementation as it seems like a simpler catagory to implment based on the availability of the information over some of the more complex categories that require a more time consuming process to classify.