nanog mailing list archives

Re: Next-gen firewalls and URL / domain reputation and classification


From: "C. Jon Larsen" <jlarsen () richweb com>
Date: Wed, 26 Oct 2022 16:20:35 -0400 (EDT)


A lot of the vendors are using WebRoot or Threatstop under the hood.
A10 for example with their CFW product.

Greetings and good day.
What products/services are folks using on their networks for domain reputation or classification-based
filtering? There are various vendors (Fortinet, Palo Alto, Talos/Cisco, McAfee, etc) who maintain their
own databases for this purpose, and I'm working to make sure a recently acquired domain name is classified
and evaluated correctly. I have been seeing reports from end users on a handful of different ISP networks
being blocked or redirected to something like safebrowse.io due to this sort of reputation-based filter.
Re-classifications have been submitted to a lot of the major vendors in this space, but I don't maintain
an exhaustive list, and individual ISPs seem to have varying degrees of success responding to these
requests.

Any input on the subject, or anecdotes from anyone with operational experience is much appreciated.

Thanks,
Devern

--
Devern Adamsdevernadams () gmail com




Current thread: