Block High Risk TLDs

[Josh990]

Hi All,

I want to start blocking 'high risk' top level domains within PAN-OS. Has anyone else done this successfully? 

I presume the following should work based on PAN-OS RegEX:

URL Category:

*.eg/

*.ex/

etc....

Set URL Category to 'Block' within existing URL Filtering Profile.

Cheers

[OtakarKlier]

Hello,

I would say utilize the dynamic features of the PAN to do this for you instead of utilizing specific lists. Enable all, AntiVirus, Anti-Spyware with DNS sinkhole, Vulnerability protection, URL filtering, and wildfire. Then use a secure DNS provider, either palo alto's or someone elses, and block all others. I made a video for a conference regarding secure DNS that is worth the 12 minutes.

https://youtu.be/ROIAYSEbTuo

Its all about defense in depth and machine learning, rather than static lists.

Hope this helps.

[aobszynski]

You can dig more from Unit42 post: https://unit42.paloaltonetworks.com/top-level-domains-cybercrime/ 
Also, from https://www.spamhaus.org/statistics/tlds/

If you want to do it at larger scale, EDL can be a better choice than static entries.

[Josh990]

Thanks for the responses all. 

I still believe PAN-OS should support blocking specific TLDs in a simple way; this seems like a fool proof way to greatly reduce the attack surface since we never need to visit sites using these TLDs for legitimate reasons.