Hi networkadmin, Generally speaking, for non-malware related URLs, PAN-DB will crawl and categorize domains as we see them. This can happen either because our crawler has found a new site, someone has submitted a change request for an unknown site, or because a customer device queried our servers for that URL. As HULK mentioned above, once we see an unknown on our servers, we will put that in a prioritized queue for crawling and classification. Once we determine a category, it will get included in the next database refresh. For malware domains, PAN-DB will categorize a URL/IP as malware as long as WildFire has associated it with malicious activity. Regarding the Cryptolocker lists published by the FBI/Infragard, we do subscribe to such lists, and we will create threat signatures around them, as well as feed the domains/IPs listed into PAN-DB. For those malware families that utilize DGAs, we will phase in DNS signatures as those domains go live (typically a few days before), and then disable them as they get taken down. In the past, once we disabled signatures, we also removed the corresponding entries in PAN-DB. Starting with the most recent InfraGard list (Cryptolocker/GameOverZeus), we started adding all domains at once to PAN-DB, and will keep them categorized as malware until otherwise notified. As for your list of examples, I checked PAN-DB, and we currently categorize all of them as malware with the exception of the first two. If you have additional examples of URLs from the InfraGard list that is not categorized as malware, please send me a private message and I can check them for you and see what's going on. Thanks, Doris
... View more
