Advanced Threat Protection through XG proxy C2/Generic-C false positive bug?

Question

When we browse to the website of https://hollandia.biz/ there is no problem. But when we go to the page https://hollandia.biz/home-services/ we get the DROP by Advance Threat Protection when the XG is used as proxy server. 
 There is no ATP DROP when going direct tru the XG not using the XG proxy. 
 Endpoint Protection X does not register any threat. 
 This seems a bug in XG proxy.

LHerzog · Answer

the sub page is categorized as C&C

while the base URL is general business.

I suggest you check totalvirus for that URL and submit a URL review to Sophos Support 
 
 as this is HTTPS traffic, the XG cannot inspect the sub-page you are visiting when you don't use the Web-Proxy. So ATP only comes when the XG can see the full URL in Proxy-mode.

Advanced Threat Protection through XG proxy C2/Generic-C false positive bug?

Top Replies