This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About jstrubberg
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About jstrubberg
01-22-2021
4Posts
1Like
0Solutions
Jan 22, 2021Last Visited
User
Activity
User
Profile
Latest posts by jstrubberg
| Subject | Views | Posted |
|---|---|---|
| 2699 | 01-22-2021 08:29 AM | |
| 8143 | 12-16-2020 07:04 AM | |
| 8149 | 12-16-2020 06:01 AM | |
| 9710 | 12-15-2020 01:50 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 01-22-2021 08:29 AM |
User Badges
Community Statistics
| Member Since | 06-15-2018 08:51 AM |
| Date Last Visited | 01-22-2021 04:41 PM |
| Posts | 4 |
| Total Likes Received | 1 |
01-22-2021
08:29 AM
1 Kudo
Bit_Byte; Look at your firewall. If you have a defined object for the URL images.gistatic.org, you will see "suspicious dns query" hits with your firewall management interface as the source. That's your firewall checking to match an IP address with that URL for blocking purposes. Working as intended.
... View more
12-16-2020
07:04 AM
And we have a solution. We built a blacklist rule for the domains in question. The dns queries ARE from the firewall, it is confirming the IP addresses of those URL objects every few minutes. Thanks Palo Alto support.
... View more
12-16-2020
06:01 AM
Yes, thank you. We have followed all the mitigation advice. The issue is that we are seeing our firewall management interface IPs requesting DNS for those malicious domains, but we cannot find a requesting device asking for them in the first place. Just wondering if anyone else has seen the same behavior.
... View more
12-15-2020
01:50 PM
Starting this morning (6:20AM CST), we are seeing threat notifications of suspicious dns requsts going to a group of domains that have been named in the Solarwinds Sunburst hack. avsvmcloud[.]com websitetheme[.]com zupertech[.]com etc We've been trying to backtrack these all day. Our internal dns servers tell us that the requests are coming from the management interfaces of our HA palo alto firewalls. Palo Alto support tells us the firewalls are doing this to double check requests made by an internal machine. I've enabled dns logging and gone through those logs repeatedly, and the only requests are from the firewalls themselves. This feels like something that changed with the update we downloaded at 5:30am this morning. Anyone else seeing suspicious dns queries that just started occuring today, especially for these domains? Thanks.
... View more
- Tags:
- dns
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks