App Review Malware Obfuscation Part 1

[Andy Ful]

Yes, the website blocked by McAfee was Arvix.org (not Arxiv.org) and could be a malicious one (requires investigation).

 

[Trident]

Yes, the website blocked by McAfee was Arvix.org (not Arxiv.org) and could be a malicious one (requires investigation).

It says parked domain, so it is based on heuristics like Levenshtein Distance or on the AI models that McAfee rolled out more recently (semantics block).

Microfost.com will probably result in the same block.

The website could be malicious as well.

 

[Miravi]

It says parked domain, so it is based on heuristics like Levenshtein Distance or on the AI models that McAfee rolled out more recently (semantics block).

Microfost.com will probably result in the same block.

The website could be malicious as well.

I have a Cloudflare Gateway policy for blocking Parked & For Sale Domains, so it's also blocked on my end. Cloudflare Radar confirms the categorization.

This particular category once gave me a false positive when I wanted to visit a photographer's perfectly innocent website.

 

[Trident]

I have a policy in Cloudflare Gateway for blocking Parked & For Sale Domains, so it's blocked on my end. Cloudflare Radar confirms the categorization.

This particular category once gave me a false positive when I wanted to visit a photographer's perfectly innocent website.

Because there may be a delay between registering the domain and the domain disappearing from the parked lists.

With the DNS blocks everything is pre-curated lists, there is no real time analysis.

 

[Victor M]

some GPO to prevent users to create scheduled tasks.

That GPO only stops users from using Task Scheduler GUI to create tasks. Tasks can still be scheduled via API.