This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[9.004] Many false positives in Content filter

Hi,
i just mentioned that tonight a lot of websites are blocked by Content Filter with reason Malicious Sites not allowed.. But the sites are well known to me.
So i am guessing that either many sites were hacked tonight..... which i don't really believe .... or the ContentFilter database is way to sensible at the moment.
Some examples (german sites)
Klassik Radio Shop
http://www.sonlatino.de/
Monster.de

Anybody else expieriencing this?

Regards, Karsten

This thread was automatically locked due to age.

0 SNA over 12 years ago

Same here. This site is needed for GMX mail provider attachments and HTML view.

While trying to retrieve the URL:
https://www.gmxattachments.net/de/cgi/g.fcgi/mail/print/fullhtml?mi....

Report:
Malicious Sites not allowed.

Is it possible to report these false positives to Astaro/Sophos team?
Cancel
Vote Up 0 Vote Down

Cancel
0 SNA over 12 years ago in reply to SNA

https://www.gmxattachments.net/de/cgi/g.fcgi/mail/print/fullhtml?mi....

https://www.gmxattachments.net is suddenly working now.
Cancel
Vote Up 0 Vote Down

Cancel
0 hopkins.103 over 12 years ago

http://shop.klassikradio.de/ and http://www.sonlatino.de/ appear to still be flagged as malicious.

Today it appeared http://www.bbc.co.uk/news/ were categorized as malicious but http://www.bbc.co.uk/, http://www.bbc.co.uk/news/world/latin_america/ and http://www.bbc.co.uk/news/world/ (among others) were not.

I asked McAfee (https://www.trustedsource.org/en/feedback/url) and Sophos for further details.

So far Sophos has responded, disappointingly, leaving to us (the customer) the burden of extracting information, or correction, from their vendor.

By the time I'd gotten around to posting the BBC sites appear to be categorized as "non-malicious".
Cancel
Vote Up 0 Vote Down

Cancel
0 SNA over 12 years ago

GARD (http://www.gard.org/) is flagged as malicious. It's a healthcare site...

Is there an offical way to report those sites as false positives?
Cancel
Vote Up 0 Vote Down

Cancel
0 Scott_Klassen over 12 years ago

https://www.trustedsource.org/en/feedback/url
Cancel
Vote Up 0 Vote Down

Cancel
0 sdengscherz over 12 years ago

I suppose legitimate sites may be temporary categorized as "malicious" when something unusual is detected for example malicious js code because the webserver hosting the site has been infected or malicious code is served from 3rd party content providers such as banner advertisements.

-sd
Cancel
Vote Up 0 Vote Down

Cancel
0 SNA over 12 years ago in reply to Scott_Klassen

https://www.trustedsource.org/en/feedback/url

Thanks! [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 rsc over 12 years ago in reply to SNA

TrustedSource seems to have more than one database.

Which one is the one Sophos UTM 9 uses? Or doesn't it matter?
Cancel
Vote Up 0 Vote Down

Cancel
0 Alvin over 12 years ago

I remember I read somewhere it is that Smartfilter XL.

It simply is plain silly that we need to do so much of these.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alvin over 12 years ago

Have Fun using this Tedious Official Submission

Check the current classification of a URL and submit suggestions: Astaro Security Gateway

http://www.astarosupport.org/tools/cat/
Cancel
Vote Up 0 Vote Down

Cancel