FirePower Security Intelligence Question

[-Sparrow-]

Hello, 

I've noticed an increase in IOC's being triggered due to hosts attempting to access hxxps://gogo.thepowerrangers.com.

End users are obviously not trying to get to a power rangers site.  It seems to be a URL redirect.  Has anyone else found their FirePower SI blocking this site? It's happening multiple times a day and I'm unsure what's triggering this. Google is not my friend here. 

I had the same issue a few weeks ago with hxxps://mv-s2s-dev.ngrok.io.  That URL has subsided for the time being.

Thank you

[Sheraz.Salim]

To check the URL health go to https://www.brightcloud.com/tools/url-ip-lookup.php check firepower url engine use the statistics from this engine.

now coming back to your point. if you think this url is malicious and you need to block the rule here 

[-Sparrow- · Accepted solution]

Thanks Sheraz,
I don't necessarily think the URL is malicious, but Talos thinks it is which causes a lot of IOC's every day for hosts on our network. I just blacklisted the URL(s) and the IOC's went away. Nobody has complained yet. That's probably going to be how I resolve this in the future. Blacklist and be done with it.
Thanks!

[nspasov]

Yes, you can always utilize the white/blacklist in such situations. Also, just to mention, you can always submit a dispute directly to TALOS through the following link:

https://talosintelligence.com/reputation_center/support

Thank you for rating helpful posts!