About tehfishman

I think I see what happened; a bunch of new detections for malware communicating with that letsencrypt domain are now visible in VirusTotal, when they weren't last night. WildFire probably got that data earlier than it was available publicly on VirusTotal. The Let'sEncrypt domain likely isn't malicious, but some malware is pointing to it for some reason (maybe to check validity on a cert? sounds like it might be a cheeky way to do CNC signalling using a public service). That doesn't explain why it has happened twice in 4 days though. Maybe some other data source reported it 4 days ago and they disabled the signature once they realized it wasn't an actionable alert, then re-enabled it when more detections popped up through VT?   https://www.virustotal.com/gui/domain/x1.c.lencr.org/relations ... View more

Yeah we got bombarded by a few thousand all at once in that timeframe, I have them set to ignore until I see any evidence to suggest that they're something I should actually be concerned about. ... View more

Looks like a false positive to me, I can't see why that particular Let'sEncrypt domain is flagged as malicious. ... View more