Default Actions of the New Feeds

New Feeds

Default Action

Infoblox Base

Block - No Redirect

Infoblox Base IP

Block - No Redirect

Infoblox High Risk

Block - No Redirect

Infoblox Medium Risk

Block - No Redirect

Infoblox Low Risk

Allow - With Log

Infoblox Informational

Allow - With Log

Base Hostnames

Enables protection against known hostnames that are dangerous as destinations, such as APT, Bot, Compromised Host/Domains, Exploit Kits, Malicious Name Servers, and Sinkholes.

AntiMalware

Enables protection against known malicious hostname threats that can take action on or control of your system, such as Malware Command & Control, Malware Download, and active Phishing sites.

Ransomware

Enables protection against ransomware taking over your system. Ransomware will encrypt files on your system and require you to pay in order to get them decrypted. This feed prevents ransomware to contact the servers which it needs to encrypt your files.

Malware DGA Hostnames

Domain generation algorithm (DGA) are algorithms seen in various families of malware that are used to periodically generate a large number of domain names that can be used as rendezvous points with their command and control servers. Examples include Ramnit, Conficker, and Banjori.

Antimalware IP

Enables protection against known malicious or compromised IP addresses. These are known to host threats that can take action on or control of your system, such as Malware Command & Control, Malware Download, and active Phishing sites.

Suspicious

The Suspicious Domains feed enables protection against hostnames that have not been directly linked to malicious behavior but behave in a manner that suggests malicious behavior may be imminent.

Suspicious Lookalike

The Suspicious Lookalikes feed includes domains that appear to impersonate other trusted domains, but have demonstrated enough abnormal behavior to warrant concern.

Suspicious NOED

The Suspicious Emergent Domains feed include high risk, new domains. These domains have only recently become active, and share one or more characteristics with other known malicious domains to warrant concern.

Newly Observed Emergent Domains

The NOED feed includes recently created and newly active domain names. These are not necessarily suspicious but some organizations may wish to log traffic going to these domains as there is a low likelihood that these domains would be visited normally.

Old Feeds

to

New Feed

Base Hostnames
AntiMalware
Ransomware
Malware DGA hostnames

=>

Infoblox Base

Infoblox Antimalware IP

=>

Infoblox Base IP

Newly Observed Emergent Domains (NOED)

=>

Infoblox Informational

Suspicious 
Suspicious Lookalikes
Suspicious NOED

=>

Infoblox High Risk
Infoblox Medium Risk
Infoblox Low Risk

Extended Base & anti-malware Hostnames

Extended Ransomware

Extended AntiMalware IPs

Spambot IPs DNSNL

Logic for Upgrade Script

Step 1:

Logic Used:
If all feeds in this section have the same action, then the new action retained on the converted new feeds will be the same as it was previously. If there are mixed actions among the feeds in this section, then the newly converted feeds will retain Block as the policy action, as this feed section is Critical Risk. Infoblox aims to ensure the protection of our customers during the conversion.

Case 1A (Best: No mix, all Block)

New Action

Base Hostnames

Block

AntiMalware

Block

Infoblox Base

Block

Malware DGA hostnames

Block

Ransomware

Block

Case 1B (Best: No Mix, all Allow)

New Action

Base Hostnames

Allow

AntiMalware

Allow

Infoblox Base

Allow

Malware DGA hostnames

Allow

Ransomware

Allow

Case 2 (possible: 1-2 mixed)

New Action

Base Hostnames

Block

AntiMalware

Block

Infoblox Base

Block

Malware DGA hostnames

Allow

Ransomware

Block

Case 3 (Worst: Most mixed)

New Action

Base Hostnames

Allow

AntiMalware

Block

Infoblox Base

Block

Malware DGA hostnames

Allow

Ransomware

Allow

Step 2:

Logic Used:
If customers have any of the feeds listed below, Infoblox will add the new feed (with change of name). This new feed will maintain the same policy action as it did previously.

New Action

Retained as is (in same precedence with same action), no change

Antimalware IP

Infoblox Base IP

Step 3:

Logic Used:
If all feeds in this section have the same action, then the new action will be retained in the converted new feeds. If the feeds have mixed policy actions (i.e., even if one of the feed's action is Block), then in the converted new feeds, the action will be set to Block for High and Medium risks, while Low risk will be set to Allow with logging enabled. This section is NOT considered Critical Risk, and the indicators can fall into any of the three risk categories (High, Medium, and Low). In a mixed-case scenario, Infoblox aims to ensure that our customers are safeguarded against High and Medium risk indicators, while Low risk indicators can simply be logged.

Case 1A: (Best: No mix, all Block)

New Action

Suspicious

Block

Infoblox High Risk

Block

Suspicious Lookalikes

Block

Infoblox Med Risk

Block

Suspicious NOED

Block

Infoblox Low Risk

Block

Case 1B: (Best: No Mix, all Allow)

New Action

Suspicious

Allow

Infoblox High Risk

Allow

Suspicious Lookalikes

Allow

Infoblox Med Risk

Allow

Suspicious NOED

Allow

Infoblox Low Risk

Allow

Case 2: (Possible: 1 mixed)

New Action

Suspicious

Block

Infoblox High Risk

Block

Suspicious Lookalikes

Allow

Infoblox Med Risk

Block

Suspicious NOED

Allow

Infoblox Low Risk

Allow - with Log

Case 3: (Worst: 2 mixed)

New Action

Suspicious

Block

Infoblox High Risk

Block

Suspicious Lookalikes

Allow

Infoblox Med Risk

Block

Suspicious NOED

Block

Infoblox Low Risk

Allow - with Log

Step 4:

Logic Used:
If customers possess any of the feeds mentioned below, Infoblox will introduce the new feed (with change of name) and apply the same policy action to them.

New Action

Retained as is (in same precedence with same action), no change

NOED

Infoblox Informational