22 ms·
Why don't you use a vendor that provides the concrete URLs as IOCs to block?
by ricardobayes 5y ago
Why don't you use a vendor that provides the concrete URLs as IOCs to block?
- ocdtrekkie 5y agoThat's fine for blocking malicious content that's already been reported. But if there's no legitimate need to allow the domain, why not block it entirely and prevent even being the ground zero for a new URL? If my organization is likely enough to be targeted intentionally, the chance of having an attack directly solely at my organization (and hence, likely a URL not found by other parties already) is much higher as well.