Google Threat Intelligence

I have reported the domain to Google Safe Browsing multiple times and checked VirusTotal for malware or C2 botnet infection, but when I report it on https://safebrowsing.google.com/, I don't see any results indicating the domain is restricted.

Hello Cloudflare Sales Team,We are a cybersecurity company operating in Türkiye and actively provide services to multiple corporate brands.There are numerous phishing websites currently impersonating the brands we protect. Our request is specifically for Cloudflare to apply warning/interstitial notices to these malicious websites in order to protect end users.If this warning service can be provided quickly and efficiently, we would like to proceed with a commercial collaboration and purchase this service from Cloudflare.For your reference, screenshots of sample phishing websites are included in the attached file.We kindly ask you to share further details regarding: Service scope and availability Commercial terms Onboarding and next steps We look forward to your response.Kind regards,

Why does Mandiant make it so hard to opt-out from their attacks? They do not provide any reverse DNS for their attack points, thus hiding their identity behind fake or hosted whois data

AI agents and agentic browsers are starting to act as full participants in the digital economy - discovering products, comparing prices, even initiating transactions on their own.If this becomes the norm, our threat models are about to shift fast.Google’s SAIF framework calls for extending detection and response to AI systems, automating defenses at machine speed, and harmonizing controls across platforms.But here’s the tension: most organizations today can’t even see when an AI agent is the one interacting with their site, applications or API.That raises some big questions for this community: How should we distinguish legitimate agentic browsing from automated abuse? What happens when agentic browsers start exploiting business logic or scraping at scale, intentionally or not? How do we build consistent policies across web, employee desktops, mobile, and A

New Feature for Saved IOC Searches:  We have enhanced the Intelligence Search workflow to eliminate repetitive manual entry. Threat hunters can now build complex queries once and save them for future use. This allows teams t

 This Google Threat Intelligence search query is designed to identify files submitted from specific countries, along with community feedback indicating the presence of a Ransom note, which strongly suggests a potential victim from that country and is sharing that intelligence. submitter:DE comment:"SUSP_RANSOM_Note" 

 This Google Threat Intelligence search query uses a high-fidelity byte signature to instantly identify LockBit 3.0 ELF ransomware samples. content:{34043B5C0B8CFB1AEEDB995A9AA9EE19F9AA9AEE9A09DACA299AAAEE6E09F9EE9A69A99A09B95AF909EEBA6ADA097A9AB95E5000F30668841826EF11C041B0CFA3C0AE5E4FA36E5EAE7E8F2F4FA3CEAE5F4F01A3535FA323A2D1

 This Google Threat Intelligence search query is designed to hunt for malicious files that attempt to confuse, manipulate, or evade security Large Language Models (LLMs) by embedding specific adversarial commands or "jailbreak" phrases. entity:file (crowdsourced_ai_analysis:"DAN" or crowdsourced_ai_analysis:"ignore previous instructions" or cro

For the best results using Mandiant Attack Surface Management,  add the following IP addresses to your allowlists: 34.68.34.64/27 8.34.210.32/27 Visit the documentation for information on the Mandiant ASM scan rages.    

Hello Google Cloud Community,I would like to clarify a point regarding Google SecOps licensing.I have been reviewing the official documentation, including the "Applied Threat Intelligence overview" and "Emerging Threats overview." The documentation states that the Applied Threat Intelligence (ATI) and Emerging Threats features are available with the Google SecOps Enterprise Plus license.However, it is not entirely clear whether these features are excluded from the Enterprise license.Could someone please confirm my understanding?Is it correct that the Applied Threat Intelligence and Emerging Threats features are unavailable with the Enterprise license? Is the Enterprise Plus license strictly required to use them?Thank you in advance for your help.

Hi TeamAm looking to create outbound rule  from firewall to the GCTI IP.  So using the below lines in my rule as suggested by the SECOPS. Expecting your support on this for better understanding.    $feed.graph.metadata.entity_type = "IP_ADDRESS"    $feed.graph.metadata.product_name = "GCTI Feed"    $feed.graph.metadata.source_type = "GLOBAL_CONTEXT" 1. I would like to know how to validate the above lines and its values. If i do the UDM search i can able to see the   graph.metadata.source_type = "DERIVED_CONTEXT" and not the graph.metadata.source_type = "GLOBAL_CONTEXT"Since i have the source type : Mandiant Threat Intelligence. (Refer : Below Snap-2)  3. How i can confirm GCTI feeds are integrated. 4. Is the feeds are updated at any frequency or feeds are updated live. Snap:1

 Day 4: Hunting Gamaredon-Related Document Activity This Google Threat Intelligence search query is designed to find files that match a specific set of characteristics, generally indicative of a particular type of malware or activity. (type:document) and (behavior_processes:*.ru* and behavior_processes:*DavSetCookie* and behavior_processes:*http*) and (behavior_network:*.ru* or embedded_domain:*.ru* or embedded_url:*.ru*)  

 Day 1: Google Threat Intelligence search a day keeps the phishing away… This Google Threat Intelligence search query is designed to find potentially malicious or misleading domains that are similar to netflix.com but are not the official domain itself. entity:domain fuzzy_domain:netflix.com and not domain:netflix.com creation_date:90d+  Query Breakdown: The query uses specific search modifiers (

 This query is designed to identify and block the Command and Control (C2) domains used by the Gamaredon (also known as Primitive Bear or UAC-0010) threat actor, a highly persistent group with reported ties to Russia, often targeting entities in Ukraine. entity:url tld:ru path:"/DESKTOP-*" (have:communicating_file or have:refer

 This sophisticated search is designed to unmask active file delivery domains used by threat actors in targeted espionage campaigns against sensitive UK sectors like the Ministry of Defence (MOD), National Health Service (NHS), and His Majesty's Revenue and Customs (HMRC). entity:url (hostname:"*-govuk*" or hostname:"*mod-uk*"

 This search is designed to identify files that use a specific, hardcoded User-Agent string during their dynamic analysis, which is the tell-tale signature of a Cobalt Strike beacon attempting covert Command and Control (C2) communication. entity:file behavior:"Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)

 This targeted search is designed to hunt for files that are high-conviction malware but still rely on a valid, non-revoked digital signature. This often points directly to newly stolen code-signing certificates or fresh, high-trust payloads. tag:signed not tag:revoked-cert not tag:invalid-signature p:5+

 This search identifies files whose malware configuration contains SMTP or IMAP fields, which typically indicates the malware uses an email-based mechanism for communication or data exfiltration. malware_config:"smtp" or malware_config:"imap" Quer

 This targeted search is designed to provide an efficient, daily list of files that are newly uploaded, validated with multiple antivirus detections and high-quality sandbox reports, yet currently lack Sigma rule matches. This allows detection engineers to prioritize coverage gaps in their security monitoring infrastructure. p:5+ (sandbox_name:

 This search query is designed to hunt for newly created or emerging malware that specifically targets information (stealers) by leveraging Program Database (PDB) file metadata which is often overlooked but can contain revealing developer-left strings. entity:file metadata:".pdb" metadata:"stealer" p:5+ fs:30d+

 This Google Threat Intelligence search query is designed to identify newly created, algorithmically generated domains (DGA) with multiple positive detections, which were registered through a registrar frequently abused by threat actors. entity:domain p:5+ tag:dga registrar:"NICENIC INTERNATIONAL GROUP CO., LIMITED" creation_da

 This VirusTotal Intelligence search query is designed to identify IP addresses acting as potential Command and Control (C2) servers. It specifically targets infrastructure that is serving or being contacted by a small number of malicious files and uses newly issued self-signed SSL certificates—a strong signal of newly deployed or low-profile C2 infrastructure.