Checking Potentially Dangerous Malware Domains

[User27605043]

Each week we get a list of potentially dangerous malware domains. Usually this is between 2 and 6 sites to test. My normal process is to check them against Trustedsource.org. As our MWGs are set to block High Risk and Medium Risk sites, any in the list that Trustedsource.org identifies as such are not added to our block list. I will then add any that are not identified as a risk to the Global Block list.

Today I got a list that contains over 50 new domains to check. So the question is, is there any method that would allow me to check a group of Domains against GTI rather than doing them one by one?

Thanks,

[asabban]

Hello,

unfortunately we do not support batch rating as of today. There were plans for a customer facing API but I have no idea if this still exists or will be available in the future. I see three options:

1.) Rate them manually (probably not what you want to do...)

2.) Send me the list, I have a script to rate them

3.) Use your MWG to rate the URLs. It is possible to build a few rules to make something like a "URL Categorizer", then use a script to send your domains against this MWG to rate the URL and return the category.

Best,
Andre

[User27605043]

I sent the list. 

By the way a feature like that should be available. I would put in a feature suggestion, but I am not. 

Why? I have been a McAfee Customer for over 20 years. In that time, I have requested many over the years. None of them have been addressed or even acknowledged. 

I guess, there is some threshold for those suggestions to be considered. Anyway this one is a no brainer.

We should be able to submit more than one URL/Domain at a time for Trustedsource.org review.

Thanks,

[AaronT · Accepted solution]

If you sign into Trusted Source you can click "Check URL List File" and upload a file of upto 100 urls/hosts to have examined.  I believe each is individually listed in the "Track URL Ticket Status" after you upload it.  We've used this numerous times.

It gives the categorization, but I'm not sure about the risk level, as it's been a while since I've used it.  Hopefully this helps.

Aaron