About cblackmore

hshah, craigmueller's original question was about a DNS signature, not URL Filtering functionality (whether BrightCloud or PAN-DB). BrightCloud is not a factor in how we generate DNS signatures. Feel free to submit a change request to BrightCloud, but it will not affect our signatures. VirusTotal does not believe blonde.crazytall.com to be malicious. VirusTotal is simply a data aggregator, and the data it has aggregated shows that of 57 URL scanners, none believe this domain to be malicious. The DNS signature exists for the reasons I stated earlier. ... View more

hshah -- BrightCloud's categorization is likely incorrect. We've observed the crazytall domains being used to serve ads, which is perfectly legitimate. However, we've also observed malware connecting out to these domains. Thus, we do not categorize the domains as malicious, because they aren't; but we do categorize them as suspicious, because, as Steven Puluka indicated, accessing them may indicate malware on the endpoint. That said, per Steven's submission to Test A Site, "Computer and Internet Info" probably isn't the best categorization. It's worth requesting a review of that, even if the optimal bucket isn't "Malware." ... View more

Hi Steven -- In the case of ThreatVault, the mere inclusion of a file indicates its status: Every file in ThreatVault meets the criteria of 1) Is a threat, and 2) Has protections available. If a file doesn't appear in ThreatVault, you can check it through the WildFire portal (or on the firewall), or by retrieving the PDF or XML report using the WildFire API. ... View more

Hi Steven -- The confusion here stems from the fact that folks are looking at threatvault2.paloaltonetworks.com rather than wildfire.paloaltonetworks.com. To be clear, the Havex samples are classified as malware, have been since June 24, and would show up with that verdict if seen on a firewall that has access to the WildFire cloud today. There absolutely is a feedback mechanism in place here. The individual VM verdicts shown in ThreatVault (e.g. "This sample was found to be benign on this virtual machine") are an oversight on our part -- they don't always correspond to the current disposition of the sample, and weren't intended for display in ThreatVault reports. I've filed a bug to have them removed so we can avoid confusion on this issue in the future. ... View more