Threat ID 411977850 created 2021-06-11 13:58:04 (UTC)

[LeeFrancis2]

We are investigating alerts of this DNS signature for  x1.c.lencr.org.

I'd expect that a match for a clear text string in a DNS Request that it is very unlikely this is a false detection.

However to get alerts so quickly after this signature creation, suggests we are either very unlucky or  a very common public internet resource if causing this fly-by access. Anyone else receiving this threat alert shortly after an apparent WF update.

KR,

Lee

[AgamJain]

We have seen alert for x1.i.lencr.org as IOC for revil ransomware, although not seen anywhere else. Just chrome communicating to this domain. Still validating with support on this.

[mivaldi]

This is a benign Let's encrypt domain. The URL categorization has been cleared.

There was an issue that was resolved in 9.0.10-h2, 9.1.6, and 10.0.2, that caused URL's previously in a malicious category to get 'stuck' in that malicious category in the Firewall's DP Cache. See https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCgjCAG

If you are running a PAN-OS version that is higher than the ones mentioned above, and you see the URL categorization stuck in a malicious category, even after it being cleared out to be Benign (verifiable in Test-A-Site), please open a Support case to have the issue investigated for root cause.