malware??

[VSU_ITSEC]

Dumb question perhaps, but why is www.googletagservices.com/tag/js/gpt.js being flagged as a malicious URL?  It doesn't come up that way in PA's URL filtering site.

It's created a considerable jump in my botnet list.

Thanks in advance...

//moe

[HULK]

Hello VSU_ITSEC,

Recently, There was a BUG identified for the same and The fix has been shipped with current PAN-DB version.

Thanks

[HULK]

Hello VSU_ITSEC,

Could you please let us know what URL DB version running on your PAN firewall...?

Thanks

[VSU_ITSEC]

6.0.3

[HULK]

I hope 6.0.3 is the PAN OS version, but what is the URL DB version. You will get this information from GUI dashboard > General Information > URL Filtering version. OR from CLI > Show system Info  ---

Thanks

[HULK]

A good doc for your reference: How to Handle a URL Miscategorization

Thanks

[hshah]

Hi VSU_ITSEC,

I just did PAN-DB URL Lookup and its classified as Comp&Inter.

Best match	googletagservices.com
Category	computer-and-internet-info

Can you please provide me output for "test url googletagservices.com".

Regards,

Hardik Shah

[VSU_ITSEC]

URL

googletagservices.com

Category

  Search Engine

Any yes, that was my PAN- OS version #, my bad... URLfiltering is 2014.09.22.470

[hshah]

Hi VSU,

Firewall is doing correct catagorization, hence its not issue of mis-categorization.

admin@93-PA-VM-200> test url-info-cloud googletagservices.com

BM:

googletagservices.com,9,5,search-engines

www.googletagservices.com/tag/js/gpt.js,1,5,search-engines

www.googletagservices.com,1,5,computer-and-internet-info

Can you put enlarged URL/Threat log here. That will help us to understand issue in detail.

Regards,

Hardik Shah

[hshah]

Hi VSU,

Please find virustotal analysis, its not a malware.

https://www.virustotal.com/en/url/50ddccd826c769b904f0d115b89c71faaab91882ec50fbf76a791ee848c5c7d4/a...

Hence provide us threat/URL log to confirm potential false positive.

Regards,

Hardik Shah

[VSU_ITSEC]

from the CLI

@PA-5020-P(active)> test url www.googletagservices.com/tag/js/gpt.js

www.googletagservices.com/tag/js/gpt.js search-engines (Base db) expires in 0 seconds

www.googletagservices.com/tag/js/gpt.js search-engines (Cloud db)

i'll get the URL/threat log in a few...

[VSU_ITSEC]

[HULK]

Hello VSU_ITSEC,

It seems currently the PAN firewall is categorized properly. The above mentioned logs is for 09/22/14. As i said before, we had an issue with prior version and that has been fixed now. That is why, you don't have logs for current date ( 09/23/14-Block-URL).

Hope this helps.

Thanks

[hshah]

HI VSU,

Thanks for providing URL Logs, its confirmed now that its yesterdays log.I agree with HULK. Today classification looks good. Let us know if issue still appears.

Regards,

Hardik Shah

[VSU_ITSEC]

Have a new site in today's list with the same issue: g.symcd.com.  This is new for us (so is the device); how often does this happen?