Introduction
This document describes why you can see domains with a wildcard attached to them in the Top Domains report in Cisco Umbrella.
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
The information in this document is based on Cisco Umbrella.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Overview
Sometimes when viewing your Top Domains report, you can see domains with a wildcard attached to them. Some of the most common examples of this include domains such as:
- *.dyndns.org
- *.amazonaws.com
- *.l.google.com
Understand Domain Trimming
Cisco Umbrella uses a Domain Trimming feature in the Top Domains report, as well as in Scheduled Reports. This feature takes a group of subdomains and groups them together as a singular domain with a wild card attached to it. If Umbrella did not do this, the Top Domains reports can be littered with these sub domains and would not have as much valuable information.
To provide an example of this, these domains can count towards the count of *.l.google.com:
- play.l.google.com
- www-google-analytics.l.google.com
- plus.l.google.com
- gas.l.google.com
- sandbox.l.google.com
- mobile.l.google.com
Locations where Domains Show in Full
The only locations that these domains show as having wildcards is in the Scheduled Reports and in the Top Domains reports. Everywhere else, they show with their full domain names.
Feedback