malware??

[VSU_ITSEC]

Dumb question perhaps, but why is www.googletagservices.com/tag/js/gpt.js being flagged as a malicious URL?  It doesn't come up that way in PA's URL filtering site.

It's created a considerable jump in my botnet list.

Thanks in advance...

//moe

[HULK]

Hello VSU_ITSEC,

Recently, There was a BUG identified for the same and The fix has been shipped with current PAN-DB version.

Thanks

[HULK]

Hello VSU_ITSEC,

Could you please let us know what URL DB version running on your PAN firewall...?

Thanks

[VSU_ITSEC]

6.0.3

[HULK]

I hope 6.0.3 is the PAN OS version, but what is the URL DB version. You will get this information from GUI dashboard > General Information > URL Filtering version. OR from CLI > Show system Info  ---

Thanks

[HULK]

A good doc for your reference: How to Handle a URL Miscategorization

Thanks

[hshah]

Hi VSU_ITSEC,

I just did PAN-DB URL Lookup and its classified as Comp&Inter.

Best match	googletagservices.com
Category	computer-and-internet-info

Can you please provide me output for "test url googletagservices.com".

Regards,

Hardik Shah

[VSU_ITSEC]

URL

googletagservices.com

Category

  Search Engine

Any yes, that was my PAN- OS version #, my bad... URLfiltering is 2014.09.22.470

[hshah]

Hi VSU,

Firewall is doing correct catagorization, hence its not issue of mis-categorization.

admin@93-PA-VM-200> test url-info-cloud googletagservices.com

BM:

googletagservices.com,9,5,search-engines

www.googletagservices.com/tag/js/gpt.js,1,5,search-engines

www.googletagservices.com,1,5,computer-and-internet-info

Can you put enlarged URL/Threat log here. That will help us to understand issue in detail.

Regards,

Hardik Shah

[hshah]

Hi VSU,

Please find virustotal analysis, its not a malware.

https://www.virustotal.com/en/url/50ddccd826c769b904f0d115b89c71faaab91882ec50fbf76a791ee848c5c7d4/a...

Hence provide us threat/URL log to confirm potential false positive.

Regards,

Hardik Shah