Hello,
today one of my users tried to connect to a web bank site, but my ASG blocked it because it is categorized as "Malicious Site" (see the log). I tried to check the url at TrustedSource - Customer URL Ticketing System, but these are the results:
Categorization: Internet Services
Reputation: Minimal Risk
So, why ASG see this site as malicious?
2010:11:12-15:38:15 firewall httpproxy[31562]: id="0061" severity="info" sys="SecureWeb" sub="http" name="web request blocked, reputation limit" action="block" method="CONNECT" srcip="192.168.***.***" user="" statuscode="403" cached="0" profile="REF_MMGJijtmdO (Profilo Internal Standard Mode)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2750" time="0 ms" request="0xb05329b0" url="hbnet.cedacri.it/" exceptions="certcheck,certdate" error="" reason="category" category="130" reputation="malicious" categoryname="Malicious Sites"
PS: I don't want to annoying you, but I remember you all that cause of incompatibility between Astaro and the large part of browsers (ie6, ie7, ie8, firefox, opera, chorme) if you are using the proxy in a non-transparent mode and you try to reach a HTTPS website that ASG should block, you see an error page created by browser instead of Blocked Content Page. Also in this case the issue occurred. More details here: https://community.sophos.com/products/unified-threat-management/astaroorg/f/55/t/44757 - Feature request here:"Blocked content page" has to be shown also for HTTPS blocked website
bye
eclipse79
EDIT: Partially understood: HTTP://hbnet.cedacri.it/ ( not HTTPS://hbnet.cedacri.it/) is seen as malicious also in TrustedSource. So, could this behaviour be a bug? Perhaps ASG ask for hbnet.cedacri.it (only domain name) without specifying HTTPS?
This thread was automatically locked due to age.
