Block Dynamic Domain from Security Rulebase

[Mohammed_Yasin]

Already the specified Malicious URL getting a block from URL Filtering and detected in Threat Prevention with action.

it’s a dynamic FQDN/IP that has to block from the security rule base too, but the does not want to add each IP to block as he received every time.

looking for a solution where the dynamic IP can be blocked from the firewall itself so that adding the dynamic IPs or FQDN can be avoided.

apart from EDL there any other option to block the dynamic IP and URL can be block.

As the URL receives example..  www.abc.com / www.abc.2.com / www.2.abc.com / www.jhs.abc.com / www.mem1.abc.com with

dynamic IPs, only common is abc.com rest of are keep on change.

[BPry]

@Mohammed_Yasin,

Depending on what the domain is, a custom vulnerability signature could work. 

[Mohammed_Yasin]

Thanks for the update.

It's a public domain website. and already firewall see has a vulnerability for this site.

[OtakarKlier]

Hello,

If the URL filter is flagging it and blocking it, why would you want to block the IP as well? Most sites are hosted by a provider and can we attached to many different sites. Just follow the best practice for URL filtering and DNS sinkhole and let the firewall send telemetry back to PAN so they can update their data bases.

Hope that makes sense.

[pawelzwierz]

DNS Security feature can detect similar domain