search

stamparm / maltrail

Malicious traffic detection system
MIT License
6.48k stars 1.08k forks source link

No such domain issue #56

Closed DigiAngel closed 8 years ago

DigiAngel commented 8 years ago

So we are using bro-ids on the same machine as maltrail. Bro-ids does hash checks at berkeley.edu and cymru.com as shown below:

d738bb422e540fa71380bd7f53a48465be94f397.malware.hash.cymru.com
fad82312c04d92675406d191ea09a910f8ed1154.notary.icsi.berkeley.edu

I just upgraded this morning. I have no hits for "berkeley.edu" yesterday, but after upgrading I see a lot of these as: consonant threshold no such domain (suspicious)

I have the below in my whitelist, which was working before, but after upgrading it is not:

USER_WHITELIST 127.0.0.1,localhost,72.21.81.200,cymru.com,berkeley.edu,72.21.81.253,72.21.91.8,33438,33439,33440,33441,33442,33443,33444,digicert.com,globalsign.net

I have the old version tar'd up in case you might want to look at that. Thank you.

DigiAngel commented 8 years ago

2016-01-15 08_43_07-maltrail 2016-01-14 2016-01-15 08_42_48-maltrail 2016-01-15

The screenshot from the 14th shows no berkeley hits, though yesterday there were 2666 requests, so yesterdays version of maltrail was successfully whitelisting these. The screenshot from today is for the last hour. Thank you.

DigiAngel commented 8 years ago

Confirming that after rolling back to the older version of maltrail I no longer see berkeley or cymru hits getting captured by the sensor.

stamparm commented 8 years ago

This should be fixed couple of months ago