cancel
Showing results for 
Search instead for 
Did you mean: 
mike_cc
Level 7

blocked student sites, not malicious

I have some student created web sites that are being blocked by WG. The sites are pretty plain and simple, and as far as I know have no malicious code/content. How does WG classify sites? Whitelisting isn't really an option as it opens the door later on for actual malicious code...advice?

This is the message from WG.

URL Categories: Malicious Sites
Reputation: Medium Risk

Thanks,

Mike

0 Kudos
8 Replies
alexn
Level 14

Re: blocked student sites, not malicious

Your Webs are under Medium Risk Catogory at GTI system of Mcafee, You need to send this URL here to put it in their GTI DB system,

sites@mcafee.com

McAfee GTI includes the following cloud-based services:

  • McAfee GTI file reputation
  • McAfee GTI web reputation
  • McAfee GTI web categorization
  • McAfee GTI message reputation
  • McAfee GTI network connection reputation
0 Kudos
mike_cc
Level 7

Re: blocked student sites, not malicious

How does a site get classified as Medium Risk? The sites are plain and simple, no scripts or anything other than basic HTML/PHP.

0 Kudos
alexn
Level 14

Re: blocked student sites, not malicious

McAfee Global Threat Intelligence web reputation is McAfee’s comprehensive, real-time, cloud-based URL and web domain reputation service that enables McAfee products to protect customers against both known and emerging web-based threats.

McAfee’s cloud-based system receives billions of web reputation queries daily and responds with a score that reflects the likelihood that the URL, web domain, or DNS server in question is a phishing site, infected with malware, or otherwise malicious. The score is based not only on the collective intelligence from sensors querying the McAfee cloud and the analysis performed by McAfee Labs researchers and automated tools, but also on the correlation of cross-vector intelligence from file, email, and network threat data. McAfee products, such as McAfee Web Gateway , use the score in combination with product intelligence to determine action based on local policy. McAfee not only calculates reputations for URLs, but also for domains, their associated IP addresses, and DNS servers.

0 Kudos
skloepping
Level 9

Re: blocked student sites, not malicious

Hi mike_cc

as alex .......  pointed out correctly you may want to contact our Sites Team described in this KB61702:  Web Filtering: How to address miscategorized URLs and suggest alternative categorization for URLs (http://kc.mcafee.com/corporate/index?page=content&id=KB61702)

Than our sites team have a look at it again.

Best Regards

Stefan

0 Kudos
mike_cc
Level 7

Re: blocked student sites, not malicious

The trustedsource.org site shows my sites as 'unverified'. What is the best way to whitelist these sites on my WG? I tried the URL and Global Whitelists, but those didn't seem to allow the sites.

Thanks,

Mike

0 Kudos
alexn
Level 14

Re: blocked student sites, not malicious

Mike,

In your case Whitelisting these URLs will not work because of McAfee GTI web categorization.WG takes web reputaion from GTI system.

So as I provided you sites@mcafee.com ,Just shoot an email with URLs that you want to update there, and you will be all set.

You can confirm your URLs catagory here as well.

http://www.mcafee.com/us/mcafee-labs/threat-intelligence.aspx

Alex

0 Kudos
McAfee Employee

Re: blocked student sites, not malicious

Alex, Mike,

Whitelisting should always work, it's all about the order of the rules and assuming that your rules match correctly (see: https://community.mcafee.com/docs/DOC-4514).

Mike, do you have any examples of the sites? Perhaps a block page showing the issue?

Alex is correct in that the URLs should be submitted to the sites team, but perhaps we can find a way to get things working in the meantime.

Best,

Jon

0 Kudos
mike_cc
Level 7

Re: blocked student sites, not malicious

I found the issue. The "Block URLs with Bad Reputation" rule was blocking the sites. It didn't make sense to contact GTI as these are small sites that are only around for coursework. I made a rule above 'Block URLs" that allows access.

Mike

0 Kudos