topic Re: How to check ThreatCloud URL Reputation? in General Topics

How to check ThreatCloud URL Reputation?

MikeB — Mon, 20 May 2019 20:17:02 GMT

Is there a webpage to check Check Point ThreatCloud URL, IP or domain reputation online?

Re: How to check ThreatCloud URL Reputation?

Cyber_Serge — Mon, 20 May 2019 21:30:16 GMT

Are you referring to below two links?

https://threatpoint.checkpoint.com/ThreatPortal/emulation

https://www.checkpoint.com/urlcat/main.htm

Re: How to check ThreatCloud URL Reputation?

MikeB — Thu, 23 May 2019 20:33:46 GMT

Hi Frank_Yao1, thank you for your response.

The two link you mentioned not currently show the URL Reputation that Check Point ThreathCloud defines or handles for a given URL/domain/IP in real time.

with https://threatpoint.checkpoint.com/ThreatPortal/emulation you need to upload a file and with https://www.checkpoint.com/urlcat/main.htm you only get the categorization of a given domain/URL.

Re: How to check ThreatCloud URL Reputation?

Václav_Brožík — Tue, 14 Jan 2020 09:30:44 GMT

If I really need to check a URL I use this workaround:

1. Create a .doc file containing the URL as a link.
2. Upload it for emulation at https://threatpoint.checkpoint.com/ThreatPortal/emulation
3. Check the report

A dedicated service for URL reputation check would be certainly much better.

Re: How to check ThreatCloud URL Reputation?

MikeB — Tue, 28 Jan 2020 15:28:01 GMT

Nice Tip!,
but it would definitely be great if Check Point enable a service to quickly validate the reputation assigned to an URL/domain/IP by ThreatCloud, especially for TS

Re: How to check ThreatCloud URL Reputation?

Cyber_Serge — Tue, 28 Jan 2020 14:41:11 GMT

If you visit the Check point Research site, under Tools, there are a few other tools you can utilize.

https://research.checkpoint.com/

So you are looking for domain or IP reputation lookup?

Re: How to check ThreatCloud URL Reputation?

MikeB — Tue, 28 Jan 2020 15:33:47 GMT

Hi Frank_Yao1, thanks for your reply.
Im looking for IP/domain/URL "REPUTATION" assigned by ThreatCloud. This info is very important for the behavior of the Threat Prevention policy

Re: How to check ThreatCloud URL Reputation?

Harsha_Sane — Wed, 14 Dec 2022 08:59:50 GMT

Hi Team,

Still i can find the website for IP reputation checking.

Please share the Web link if any available.

Thanks,

Harsha S.

Re: How to check ThreatCloud URL Reputation?

Chris_Atkinson — Wed, 14 Dec 2022 09:25:12 GMT

There are internal tools for employees that can't be discussed here, another option would be a Horizon (Infinity) SOC trial.

Re: How to check ThreatCloud URL Reputation?

Kiro — Mon, 04 Nov 2024 17:07:01 GMT

Hi all, I realize this is an older post, but this caught my eye. Can anyone else confirm it works this way? I wasn't sure if you upload a document to the emulation if it sees if the document itself is malicious, or if there are any malicious links included in the document if it will scan the links themselves too. As an example, I created a Word doc including a link to a "simulated" malicious download link from eicar.org the emulation did not find anything malicious (unless Check Point happens to know it's not "really" malicious, but I don't know).

Re: How to check ThreatCloud URL Reputation?

Chris_Atkinson — Tue, 05 Nov 2024 09:20:43 GMT

How are you uploading the document exactly?

From memory with the TP API for example you specify if the request type is TE vs AV, typically the latter would be most appropriate for Eicar detection.

Documents containing Links (URLs) - reputation will be checked using Check Point ThreatCloud per sk95235 / sk112312.

Re: How to check ThreatCloud URL Reputation?

Kiro — Tue, 05 Nov 2024 16:07:08 GMT

Hi,

I was using this URL: https://threatpoint.checkpoint.com/ThreatPortal/emulation

The only option is to upload a file, no granularity beyond that. Is there a better URL or tool to use for something like Eicar?

Re: How to check ThreatCloud URL Reputation?

Kiro — Wed, 20 Nov 2024 15:15:29 GMT

Anything else on my last reply?