cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

FirePower Security Intelligence Question

-Sparrow-
Beginner
Beginner

Hello, 

I've noticed an increase in IOC's being triggered due to hosts attempting to access hxxps://gogo.thepowerrangers.com.

End users are obviously not trying to get to a power rangers site.  It seems to be a URL redirect.  Has anyone else found their FirePower SI blocking this site? It's happening multiple times a day and I'm unsure what's triggering this. Google is not my friend here. 

 

I had the same issue a few weeks ago with hxxps://mv-s2s-dev.ngrok.io.  That URL has subsided for the time being.

 

Thank you

1 ACCEPTED SOLUTION

Accepted Solutions

Thanks Sheraz,
I don't necessarily think the URL is malicious, but Talos thinks it is which causes a lot of IOC's every day for hosts on our network. I just blacklisted the URL(s) and the IOC's went away. Nobody has complained yet. That's probably going to be how I resolve this in the future. Blacklist and be done with it.
Thanks!

View solution in original post

3 REPLIES 3

Sheraz.Salim
VIP Advisor VIP Advisor
VIP Advisor

To check the URL health go to https://www.brightcloud.com/tools/url-ip-lookup.php check firepower url engine use the statistics from this engine.

now coming back to your point. if you think this url is malicious and you need to block the rule here 

please do not forget to rate.

Thanks Sheraz,
I don't necessarily think the URL is malicious, but Talos thinks it is which causes a lot of IOC's every day for hosts on our network. I just blacklisted the URL(s) and the IOC's went away. Nobody has complained yet. That's probably going to be how I resolve this in the future. Blacklist and be done with it.
Thanks!

Yes, you can always utilize the white/blacklist in such situations. Also, just to mention, you can always submit a dispute directly to TALOS through the following link:

https://talosintelligence.com/reputation_center/support

Thank you for rating helpful posts!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: