About Zewwy

Zewwy · ‎08-19-2024

Now I have the root domain showing up in my logs as parked and thus in my threat logs. I asked them to recategorize that one as well, and instantly sad no. Time to have another 2 month battle with PAN support. Thanks PAN I love you guys, very helpful and the stress you cause me should be a crime against humanity.

Zewwy · ‎08-19-2024

After 2 months, PAN finally decided to change the category. Yay... Thanks PAN.

Zewwy · ‎06-18-2024

Thanks Nsinghvirk, I was hoping as a community that there would be an appropriate thread topic to which discuss these matters, if this was not the one after initial creation, I was second hoping there would be forum moderators that could move the thread to a more appropriate area to get correct attention and help a Original Poster is seeking. If this is not a community driven forum, then ask me to leave, and I will gladly leave this forum site forever. Having said that, we did further investigation on the domain and source, and contact the Canadian Cyber Security and they provided us with the following additional details about the domain in question: " I received the following answer relating to your enquiry from our Cyber Incident team: This api call is viewed by checking the CBC.ca page source: The company responsible for this api is Contxtful Technologies Inc: https://documentation.contxtful.com/space/DOCS2020/1040646377/Contxtful's+Data+Approach The gist of it is that it collects mobile sensor data to use it for machine learning of user interactivity with ads. Basically, a fancy collector of data to target ads better. The amount of pings on their firewall must be due to it being related to ads and data collection. This api call has also been seen at other news article websites as well." I have forwarded this information on to the PAN category team, but every time I make a request to change the category to web-advertisements they come back stating it will remained parked. My questions now are: 1) How can I get this thread moved to a new topic area? 2) How can I get the PAN URL category team to actually change the type based on these findings?

Zewwy · ‎06-05-2024

I'm starting to get extremely frustrated at this problem. I did all the analytical work and NO ONE is helping! 1) This pops up in our firewall flooding our threat log. Why cause parked domains is part of your DNS security to be sinkholed. The domain in question is receptivity.io 2) Either using XDR queries on end machines, or Passive DNS on the destination IP addresses. Both indicated that it's due to user's navigating to CBC (Canadian Broadcasting Corporation) website (cbc.ca). You can verify this by opening your web browser and opening the dev tools (f12), navigate to cbc.ca, then in the HTML code search for "receptivity.io" and you will find it. 3) I've reached out to my local SE, and he didn't know what the domain was, and used ChatGPT which told him it's for "eptivity.io is a platform that provides marketing automation solutions. It helps businesses streamline their marketing efforts by automating tasks such as email marketing, lead generation, and customer segmentation. The platform aims to improve customer engagement and increase conversion rates through personalized and targeted marketing campaigns". If this is case then, how is it possible this domain has no public facing website to sell said service? I asked my SE if ChatGPT at any citation to source the information and I have not got a reply back. 4) I've attempted to reach out to CBC to ask if this service is legit, and if so, how are they using it, and how did they discover the service to use in the first place if there's no public facing website. 5) There appears to be a public website for Receptiviti.com, which appears to be completely unrelated. 6) I put in a request to PAN URL categorization to get it recatgorized, and if it's legit I'd assume the tech team that handles that has some better tools and techniques to do proper categorizations. But they simply reported back that they are leaving it as parked. " URL: receptivity[.]io Previous category: parked You suggested: malware New category: parked The new categorization is available starting with URL DB version: 20240603.20358" Why can I not get ANY help on this?

Zewwy · ‎05-29-2024

While I fully understand the reasoning behind your response, it in reality is not helpful. (*EDIT/UPDATE* I just noticed this thread has been created/ or moved in the Cortex XDR topic area, I do not remember picking this). Everything in your response assumes XDR is already in place, in your example '"network_story" present in XQL query builder' is only available in Cortex. See: Create an XQL Query • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal Then you simply follow up with stating using an XDR to build a timeline. Again, technically correct answers, but they are vague and lack any actual helpful insights when the assumptions are not fulfilled. What we did end up doing was using IPinfo, and other online tools to do diagnostics on the domains IPs, and with their Passive DNS options we were able to determine what sites/services are using the said domain. In this case, it was a local new agency, hence why it keeps poping up all the time, also with DNS sec by Palo Alto Network relies on URL categorizations, which in the case the domain as seen by Palo Alto Networks is "Parked Domain". I can't find any front facing public websites to denote what this domain provides a service for, which to me raises red flags. Does anyone out there provide other real help information about this domain, who are they, what do they do? The best I could find was a whois which showed the domain registered in 2021 via GoDaddy, and all other info is redacted "for privacy". Anyone else with any other insight, I would greatly appreciated it.

Zewwy · ‎04-22-2024

I recently see a lot of my end machine shitting this domain: receptivity.io Started (I dunno even know, a week ago?) My logs can no longer go far enough back to figure it out. Cause I dunno, MS edge new tab? To hopefully remove the log entries I changed our new page to open our corporate homepage instead. PAN URL Checker states its a parked domain. Palo Alto Networks URL filtering - Test A Site If it is parked why are so many of my machines trying to reach it?

Zewwy · ‎07-14-2016

Correct I've talked to my other buddy who works for a said network company, who only deploys PA firewalls. And that is normal. However even after talking with this high tiered person neither one of us could find out why this is the case. We even looked at my SPF rules in case they might be routing traffic oddly but non of my SPF rules are set for my public IP that the GP interface is set for. They are for sub networks in the same subnet but have dedicated NAT and SPF rules. These did not seem to be the reason. The oddest part is how intermittent this one gateway is vs the other with pretty much the same settings. I can't think of anything in particular that I might have changed network wise (VRouters, static routes, or zones) that would make it not work. To top it off as I mentioned anyone connected to either Portal/Gateway using the GP app on their laptops works perfectly fine (unless they happen to connect to a private network with the exact same internal subnet as my own) but that rarely happens. We event looked at my phones internal IP from my cell network instead of the NATed IP I'd be looking for on my firewall, and sure enough they didn't overlap (which would fail to connect no matter which portal/gateway I specify) So sadly again tats not the case. To top it off when I check my active sessions when I attempt to connect to the non-working gateway all sessions show exactly the same and active as the working gateway. So I know my firewall isn't blocking anything. (I even did a packet capture and see all the IKE and EAS packets to/from going through perfectly fine. This makes me feel like there most be som kind of bug going on.... At least it working on one gateway is better than no gateways. But the task of actually figuring whats going on and causing the failure is boggling my mind!

Zewwy · ‎07-13-2016

A couple months ago I noticed my VPN on my phone stopeed working. I was originally using CM 12.1 but have since moved to mashmellow touchwiz for my Galaxy S5. Def not phone related as the issue remains, and is the same no matter what phone or OS versino being used and I'll provide some infra info before decussing the issue. I have two ISP, configured GP Portal and Gateway, using their own certs and SSL/TLS profile per gateway/portal. I already discovered that internal host detection is based on having the always on mode vs on-demand. and All users connecting to either portal using GlobalPrtotect on their laptops works perfectly fine. Running PAN OS 7.0.8. The Issue. When I connect to my gateway internally it says it connects perfectly fine. (I have a no NAT rule configured to reach the gateway as normally usering hitting the internet will be NATed to said gateway IP.) If I attempt to connect to teh same gateway via LTE/4G after disabling my WiFi (internal Connection) the VPN connectino will establish perfectly fine. If I choose to connect to another WiFi, giving me a new public IP that I will be comming in from, the VPN connection attempts to connect and simply fails. I attempted the same thing on my other portal, and at first showed signs of the same issue. After playing around a bit more (changing networks not making firewall changes) it seems my secondary gateway our phones connect perfectly fine. Even after changing from cell network to wifi. I decided to look at any differences bewteen them. I couldn't find a single thing. besides them having dedicated tunnel interfaces and seperate subnet for users, but those are suppose to be diffferent per design. I can't see anything that other wise is different. I can't put a finger on this after all the things I could possibly think of to test. The only thing I noticed was I accedently name my gateway for my secondary ISP the same name as my portal and that the cert was checked off as a CA (which isn't techincally correct, that was my mistake, but it still clealry works. Can't see this being the reason as, as i mentioend, VPN on the first portal works fine interanlly, and one instance on the cell network after the fact. but not after changing networks. Anyone having any idea at all what might be the case? I also decided to check the firewall for all active sessions, and did notice that sessions remain "active" after disconnecting my VPN. Is this normal?

Zewwy · ‎07-13-2016

I'd presume if you had said ports in layer 2 mode set with a sepcific vlan then they should all be within the same subnet, using the same DHCP pool?

Zewwy · ‎05-03-2016

Hey Gerardo, Thanks so much for the suggestion. I was working with a PAN tech on the case (tier one) so had to argue about a couple things he wasn't understanding about the device, haha. We tried you answer on my own account by me changing my AD user membership, and then re-newing the PAN's user mappings, and then I found I had to create a new profile (I'm sure possibly a uninstall, or even a registry edit could have resolved it but I didn't know exactly what to look for so I simply re-created my profile) before it would change from on-demnd mode to user-logon. I asked the tech for any documentation that would state why this is. I can understand as since it's on-Demand that the user wouldn't normally connect internally, but then whats the point of teh internal host detection being available for edit when the type is set to on-demand. Seems like a UI bug or something that was merely overlooked and was just never thought of and conisdered as-is. Thanks for your answer. One last thing I noticed when I was testing and that was that the user cert I install on users system that goes into their personal certificate store of the user, when I created a new user an AD and logged into that user on a system I had installed the cert for another user, taht cert is already in the new users certificate store... I found this baffeling. The other weird part is when I removed my profile to fix the on-demand problem I noticed it removed my certificate from the store, more along the lines to be expected with a profile wipe.

Zewwy · ‎03-11-2016

Hey, Thanks for the reply. I did the following. I cleared the PanGPS.log file. I connected via the ISP 1 portal, and sure enough I get DNSQuery response 0 As it should be. I clear the log by renaming it. I change my portal address on my GlobalProtect, connects sayign externally. I then check the PANGPS.log and I don't find a single DnsQuery line in the log at all, as if it's not even trying to do internal host detection. Thoughts?

Zewwy · ‎03-07-2016

To start off... I have already read this. https://live.paloaltonetworks.com/t5/Management-Articles/GlobalProtect-not-Detecting-Internal-Network-with-Internal-Host/ta-p/53681 I'll start off with the whole story. We have 2 ISP's, setup to our PA-500's using 2 VR's. One was setup for the DMZ Zone, with it's default out ISP 1. The Second VR was users internet, with the deafult route out ISP 2. Initially GP was set up on ISP 1. Thus when users attempted to connect their sesssion would be NATed out ISP 2 back into ISP 1, with internal host detection working a treat and showed the little house on the GP sys tray icon. My goal was to move all my services over to ISP 2. Turns out I couldn't just copy the existing NAT rules since the DMZ default route was out ISP 1, and any connection attempts would fail to due an incomplete hand shake. Welcome Symmetric Return! So I got all my services to work with either external IP association. I then go to move our VPN to the shaw side using both proper DNS lookup for the portal/gateway and our own internal PKI. I fought tooth n nail and got the internal PKI setup workign just the way I want it to. Externally wokring a treat, so I attempt to connect internally, to my dismay I couldn't reach the external portal from inside the network. Checking my monitor Tab on the PA's I see no blocked traffic, I now it was getting droped somewhere in the PA, so i do a packet capture. Low and behold, my packets are geting dropped. After talking to my uber smart network engineer, we had two options (NoNAT to my ISP 2 pub IP, or do a UTurn NAT to my ISP pub IP) After making this config, I could ping and access the web portal no prob! YAY! And finally to the point of this post, everything works now except internal host detection. and it's driving me up the wall, everything I read on it and how I know my configs are it should just work at this point. But it keeps connecting my client to the VPN DHCP pool and saying its connected and I can see the traffic on teh client system. Even though it's internally connected, (I can ping and resolve the internal host detection stuff from the client system perfectly fine) to make it even weirder, When I change my portal IP to the ISP 1, internal host dtecttion works a treat change it back to ISP 2, and interanal host detection fails. same internal host detection settings on both portal/user configs, same internal network. Thoughts? I'm bashing my head on this one...

Zewwy · ‎03-07-2016

A very smart network engineer I know informed me this is due to the way google changed the way their email system worked, and is caused when users who particularly use gmail with multiple folders will cause this Threat to be triggered. He provided one of two options to help correct it. 1) get my colleague to clean up his gmail. reduce folder, etc (not likly to happen) 2) adjust the profile monitor and change it so that particular vulnerability isn't alerted on, this leave it open to exploitation. Both options are not great, thus at this point I'll simply have to ingore in.. *Sticks head in the sand* Thanks for all the replies *Cough none*

Zewwy · ‎01-06-2016

I know this was kind of asked here, and I was wondering if the best option would be to create a rule like the one mentioned in this post.. https://live.paloaltonetworks.com/t5/General-Topics/SMTP-long-MAIL-anomaly-Vulnerability-30392/m-p/2327#M1718 Since I am getting these almost everyday, and they seem to be always from one user account, and they happen to use gmail. I also use gmail but I never seem to see my account as the "attacker" which I'm not sure why his account keep showing up as the attacker. Should I just create the block rule and see if his email still works? He says he uses teh Windows Mail app with all gmail accounts.

Zewwy · ‎10-26-2015

Thanks for the response! I wasn't sure if it was goign to be possible, but thats pretty awesome using NAT over IPsec with OSPF. One question as the documentation isn't fully clear on. Do I have to have a tunnel subnet equal to the network I need to tranverse the tunnel? in this case /24 or can I still have just a point to point subnet /30 for my tunnel?

Member Since	‎03-20-2014 07:52 AM
Date Last Visited	‎10-21-2024 01:42 PM
Posts	41
Total Likes Received	4

Online Status	Offline
Date Last Visited	‎10-21-2024 01:42 PM

About Zewwy

Re: Tons of receptivity.io

Re: Tons of receptivity.io

Re: Tons of receptivity.io

Re: Tons of receptivity.io

Re: Tons of receptivity.io

Tons of receptivity.io

Re: Bazar IPsec with Xauth RSA issue

Bazar IPsec with Xauth RSA issue

Re: PA-200 DHCP Server across Interfaces

Re: GP Internal Host Detection not Working

Re: What is Peer-Split-Brain?

Re: App and Threat Compatibility MisMatch

Stop WMI-probing on User-ID Agent

Re: GP Internal Host Detection not Working

Re: Tons of receptivity.io

Re: Tons of receptivity.io

Re: Tons of receptivity.io

Re: Tons of receptivity.io

Re: Tons of receptivity.io

Tons of receptivity.io

Re: Bazar IPsec with Xauth RSA issue

Bazar IPsec with Xauth RSA issue

Re: PA-200 DHCP Server across Interfaces

Re: GP Internal Host Detection not Working

Re: GP Internal Host Detection not Working

GP Internal Host Detection not Working

Re: IMAP long tag anomaly

IMAP long tag anomaly

Re: Site-To-Site IPsec VPN tunnel same subnet both sides

Unlock your full community experience!

About Zewwy