URL classified as Malware but not sinkholed

epeeler — Tue, 27 Mar 2018 13:02:44 GMT

Hello,

Quick question for a specific URL (cia.toh.info) This URL is classified as malware in PAN-DB but doesn't show ip in the AV release notes as a malware site so it doesn't get sinkholed when we do a DNS lookup for that url. We've noticed other URLs exhibiting the same behavior.

Has anyone else seen this? Is there a disconnect between the PAN-DB classification and the AV (sinkhole) database?

Thanks.

Re: URL classified as Malware but not sinkholed

Remo — Tue, 27 Mar 2018 13:33:54 GMT

Hi @epeeler

These two sources aren't in sync completely. This domain was sinkholed with a WF update from 20160505. Some time after that the domain was removed from the dns signatures. This needs to be done over time, when it is "safe" to remove it. The list of dns signatures would simply be too big for the firewalls to handle if it would contain ALL malware domains from PAN-DB. For the dns signatures there is no cloud lookup like with PAN-DB.

@reaper: Do you agree?

Regards,

Remo

topic URL classified as Malware but not sinkholed in General Topics

URL classified as Malware but not sinkholed

Re: URL classified as Malware but not sinkholed