A domain carries a benign business-related content category in Investigate, but it has a high risk score, appeared recently and co-occurs with known malware domains. A manager argues that the business category means it is safe. How should the analyst respond?
Select an answer to reveal the explanation.
Short Explanation
A shop sign that says "Accounting Services" tells you what's supposedly sold inside, not whether the place is a front. Content categories describe topic; security indicators describe risk. When the risk score, age and co-occurrences all point the same bad way, the friendly label doesn't save it.
Full Explanation
Investigate presents several independent dimensions for a domain. Content categories describe what kind of material a site serves, such as business or news, and they drive acceptable-use policy. Security indicators, including the risk score, security categories, co-occurrences, registration age and DNS history, describe whether the domain is associated with threats. These dimensions are separate: a compromised legitimate site or a purpose-built malicious domain can carry a benign content category while every security signal is poor. The correct decision weighs the security indicators together, and here they agree on high risk. Letting the content category override them confuses acceptable use with safety. The risk score is not derived from the content category; it is calculated from security-relevant features of the domain and its behavior, so a business label does not invalidate it. Co-occurrence with known malware domains is meaningful for any domain, categorized or not, and is often the strongest sign that a domain belongs to an active campaign. Exam caveat: no single indicator is conclusive, but agreement among several poor indicators justifies blocking. Operational check: document the risk score, registration age and co-occurring domains, block the domain through a destination list, and look for hosts that resolved it.