Malware URL not being flagged as Malware
We've had some Phishing attacks at work and I've been looking at the URLs the attacks are going to. Yes, we have users falling for them. I noticed that the url api[.]kali365[.]xyz was a url that was used. After looking it up via "VirusTotal" and "CiscoTalos", they both say they are Malware, but the Firewalla thinks it's fine. Even the FirewallaAI thinks it's okay. Is there a place to report this for the Firewalla Team?
-
Thanks for posting it here. We'll forward it to the team.
Most of the time, if a flow is incorrectly categorized, you can report it in the app. We'll see if we can improve this feature for all flows in the future.
In the meantime, please block this site, and consider blocking other things, such as the NRD Target List or TLD Risky Domains, like *.xyz.
-
In the meantime, please block this site, and consider blocking other things,
such as the NRD Target List or TLD Risky Domains, like *.xyz.Took your advice and blocked the TLD Risky Domains. Created a Target List with your suggested list. Added as a Rule and to match "domain only". Working as expected, but ended up see a blocked flow to "api.weather.com" for some reason. Single flow, but the "Matched By" was the Block Risky TLD Rule .... Found it odd as there are no "*.com" in the target lists. Not even a *.weather TLD or anything.
Please sign in to leave a comment.
Comments
5 comments