Virtual Secure Web Gateway

 View Only

  • 1.  URL Blocked because of Malware but validation sites say the URL is ok

    Posted May 16, 2014 10:24 AM

    Hello Symantec,

    Our SWG is blocking a URL because it's considered a known malware domain "expediteper.web713.discountasp.net" but other web validation sites say it's ok.  Here's some examples:

    Norton Safe Web
    https://safeweb.norton.com/report/show?url=web713.discountasp.net

    McAfee SiteAdvisor
    http://www.siteadvisor.com/sites/expediteper.web713.discountasp.net

    ScanURL.net
    http://scanurl.net/?u=expediteper.web713.discountasp.net&uesb=Check+This+URL#results


    Why does SWG classifiy it differently?

    Thanks,
    Todd

     



  • 2.  RE: URL Blocked because of Malware but validation sites say the URL is ok
    Best Answer

    Posted May 27, 2014 09:56 AM

    I'd recommend you follow the below article to investigate suspected cases of incorrect blocking:

    Troubleshooting Symantec Web Gateway URL categorization and blocking issues.

    Article:TECH210787  |  Created: 2013-09-23  |  Updated: 2013-09-23  |  Article URL http://www.symantec.com/docs/TECH210787

    This article provides links to a categorisation review tool so you can see what the SWG would mark it as (assuming it is up to date).

     



  • 3.  RE: URL Blocked because of Malware but validation sites say the URL is ok

    Posted May 27, 2014 10:34 AM

    Thanks that link was helpful.  I actually had to open a support case with Symantec because it was being blocked as a malware domain.  I did try re-categorizing the URL within SWG, but since it wasn't a category problem it had no affect.

    Thanks for the links which will be helpful in the future!



  • 4.  RE: URL Blocked because of Malware but validation sites say the URL is ok

    Posted May 27, 2014 10:38 AM

    No problems, I'm glad you found it useful laugh

    As always, please mark the appropriate post as the Solution in order to aid others who may have similar quries in the future.