wildfire findings into the pan-db

[sebastian]

Hi there,

today a user tried to download a wallpaper from www.wallsave.com

Wildfire says it is Malware.

https://wildfire.paloaltonetworks.com/wildfire/reportdetail/2d6540e44f081882b611e1ed702e8f0032d309f0...

A few engines from virustotal also:

https://www.virustotal.com/de/url/59e5f7d67a03d71946dd6b617c1ff130aec6b6b4178519ad9d77cc076b5c7a17/a...

(www.wallsave.com/get/2588352)

So my question is: why or when is this site marked as malware in the pan-db cloud?

actual:

>test url-info-cloud http://www.wallsave.com/

BM:

wallsave.com,9,3,shareware-and-freeware

Thanks, Sebastian

[tiwara]

I think the URL reputation is malware and malicious site . which version of wildfire you are using .

[sebastian]

Now it's getting funny.
Can please someone explain that to me?

That's my response to my change request for that malware site.

---
SUBJECT: Change request processed for: www.wallsave.com

Thank you once again for your submission. After careful evaluation, we have determined that the original categorization is correct, and as such, its category will not change.

URL: www.wallsave.com
Current category: shareware-and-freeware
You suggested: malware
If you'd like to submit another request, please visit:
http://urlfiltering.paloaltonetworks.com/testASite.aspx

Thanks,
Palo Alto Networks

[dyang]

Hi Sebastian,

Generally speaking, if WildFire has identified a downloaded file as malicious, the corresponding domain should also be categorized by PAN-DB as malware.  There are a few exceptions to this, so I'm looking into the reason for your case.  I'll report back as soon as I get more information.

--Doris