Thread Info
  • State Suggested Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 23 replies
  • Answers 1 answer
  • Subscribers 9 subscribers
  • Views 44270 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Website Blocked

KAR AAR

Hi,

 

All of a sudden, we are facing issue with several websites. No change been applied but the the problem started itself.

Any advice for bellow issue.

Regards

 

Website Blocked
  • Location: www-01.ibm.com/support/docview.wss
  • Your organization's policy prohibits access to websites categorized as Phishing & Fraud.
  • Return to the page you were previously viewing.
 
sophos web protection


This thread was automatically locked due to age.
Parents
  • 0

    Hi  

    Please do share the details of the several websites that are being blocked so that we can have it reviewed. What you have mentioned is similar to Sophos Central blocking https://login.microsoftonline.com' due to category 'Spyware' that was reported earlier and it is now resolved.

    Regards,

    Gowtham Mani
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Gowtham Mani

    Same issues here - Looks to be corrupted/broken defs?

     

       Latest web events                       Date/time     User          URL           Action        Reason        Referring URL Reference ID 
                                               16/10/2017 11:43:44 *****      forms.office.com Block         Phishing & Fraud                           
                                               16/10/2017 11:29:45 *****      gallery.mailchimp.com Block         Spyware                                  
                                               16/10/2017 11:29:31 *****      gallery.mailchimp.com Block         Spyware                                  
                                               16/10/2017 11:28:32 *****      forms.office.com  Block         Phishing & Fraud                           
                                               16/10/2017 11:26:42 *****      forms.office.com  Block         Phishing & Fraud                           
                                               16/10/2017 11:26:23 *****      forms.office.com  Block         Phishing & Fraud                           
                                               16/10/2017 11:25:41 *****      forms.office.com  Block         Phishing & Fraud                           
                                               16/10/2017 11:24:22 *****      forms.office.com  Block         Phishing & Fraud                           
                                               16/10/2017 11:17:39 *****      geo-um.btrll.com  Block         Spyware                                  
                                               16/10/2017 11:16:21 *****      o.aolcdn.com/ads/adchoices.pngBlock         Spyware       live.sport.co.uk

  • 0 in reply to MichaelMcLannahan

    Hi  

    Thanks for the details, will check about these sites and get back to you.

    Regards,

    Gowtham Mani
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

Reply Children
  • 0 in reply to Gowtham Mani

    We are seeing the same thing out of the blue. The following domains are showing up as blocked. They all appear to be ad-serving domains, so I don't know that it's a bad thing, but it just started and we're seeing lots of them:

     

    *.btrll.com

    *.adsrvr.org

  • 0 in reply to Dustin Garden

    I am seeing the same thing this morning. It appears btrll is related to yahoo ad tracking.. I am seeing it all over the place. 

  • 0 in reply to KAR AAR

    Here're some more sites.

  • 0 in reply to KAR AAR

    Hi  &

    Please do DM the links in text format , which would help me in having it checked swiftly.

    Regards,

    Gowtham Mani
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Gowtham Mani

    ++Gowtham Mani,

    Please find below the sorted few sites list.

    Date/time URL Action Reason Referring URL
    16/10/2017 16:04 allied.direct.abl.com.pk Block Phishing & Fraud
    16/10/2017 14:10 ci3.googleusercontent.com Block Phishing & Fraud
    09/10/2017 10:07 dsf4t5jfds34j.com/1346346.css Block Phishing & Fraud mrelhlawany.com/pr/1774
    09/10/2017 10:07 dsf4t5jfds34j.com/1346346.html Block Phishing & Fraud mrelhlawany.com/pr/1774
    15/10/2017 23:15 js.bestquickcontentfiles.com/dl.min.js Block Phishing & Fraud check.theforeverlasting2upgrade.club
    14/10/2017 9:59 lh6.googleusercontent.com Block Phishing & Fraud
    15/10/2017 17:17 lh6.googleusercontent.com/-KU7jOCN-kUQ/AAAAAAAAAAI/AAAAAAAAABA/MODiIuk698c/s35-c/photo.jpg Block Phishing & Fraud pics2islam.blogspot.com/2010/12/blog-post_7799.html
    16/10/2017 16:26 out.easycounter.com Block Phishing & Fraud
    15/10/2017 17:40 r1.res.office365.com Block Phishing & Fraud
    15/10/2017 23:16 www.yourreliablupgrades.bid/bl.php Block Phishing & Fraud linkshrink.net/7Yuysb
    15/10/2017 14:26 www-01.ibm.com Block Phishing & Fraud
    15/10/2017 14:24 www-01.ibm.com/support Block Phishing & Fraud
    15/10/2017 14:48 www-01.ibm.com/support/docview.wss Block Phishing & Fraud
    15/10/2017 10:15 www-01.ibm.com/support/search.wss Block Phishing & Fraud www-01.ibm.com/support/docview.wss

  • 0 in reply to Gowtham Mani

    Latest web events Date/time User URL Action Reason Referring URL Reference ID
    10/16/2017 9:12:19  use-tor.adsrvr.org    Block Spyware
    10/16/2017 9:12:10 use-tor.adsrvr.org    Block Spyware
    10/16/2017 9:00:32 use-tor.adsrvr.org    Block Spyware
    10/16/2017 8:56:20 use-tor.adsrvr.org    Block Spyware
    10/16/2017 8:54:33 use-tor.adsrvr.org    Block Spyware
    10/16/2017 8:54:33 geo-um.btrll.com        Block Spyware
    10/16/2017 8:54:29 use-tor.adsrvr.org    Block Spyware
    10/16/2017 8:54:24 geo-um.btrll.com        Block Spyware
    10/16/2017 8:53:25 o.aolcdn.com         Block Spyware
    10/16/2017 8:53:18 o.aolcdn.com         Block Spyware

  • 0 in reply to Brian Rohllf

    Hi  &  

    Thanks for the input ,we have already re-categorized few of the mentioned sites and working on the rest. I will keep the thread updated once all the reported sites are verified and sorted.

    Note: It might up-to 2 hours for the changes to take effect.

    Regards,

    Gowtham Mani
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

  • 0 in reply to Gowtham Mani

    These too please. This issue seems rooted at a higher level then re-categorization per domain. Also, this is from a user opening an email on OWA. Clicking a link inside the email won't let them in. But if they copy paste the URL in the browser they have access w/o issue. Please advise.

     

    10/16/2017 1:57:31    download.bleepingcomputer.comBlock         Spyware                                   
                                               10/16/2017 1:52:38    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                               10/16/2017 1:52:26    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                               10/16/2017 1:52:19    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                               10/16/2017 1:51:27    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                               10/16/2017 1:48:55    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                               10/16/2017 1:47:54    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                               10/16/2017 1:44:58    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                               10/16/2017 1:40:02    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                               10/16/2017 1:38:27    nam04.safelinks.protection.outlook.com  Block         Spyware

  • 0 in reply to Gowtham Mani

    It looks like it stopped flagging these sites for a while, but has started up again this afternoon. Are these sites supposed to be blocked?

     

Unfiltered HTML