Website Blocked

Hi KAR AAR 

Please do share the details of the several websites that are being blocked so that we can have it reviewed. What you have mentioned is similar to Sophos Central blocking https://login.microsoftonline.com' due to category 'Spyware' that was reported earlier and it is now resolved.

Same issues here - Looks to be corrupted/broken defs?

   Latest web events                       Date/time     User          URL           Action        Reason        Referring URL Reference ID 
                                           16/10/2017 11:43:44 *****      forms.office.com Block         Phishing & Fraud                           
                                           16/10/2017 11:29:45 *****      gallery.mailchimp.com Block         Spyware                                  
                                           16/10/2017 11:29:31 *****      gallery.mailchimp.com Block         Spyware                                  
                                           16/10/2017 11:28:32 *****      forms.office.com  Block         Phishing & Fraud                           
                                           16/10/2017 11:26:42 *****      forms.office.com  Block         Phishing & Fraud                           
                                           16/10/2017 11:26:23 *****      forms.office.com  Block         Phishing & Fraud                           
                                           16/10/2017 11:25:41 *****      forms.office.com  Block         Phishing & Fraud                           
                                           16/10/2017 11:24:22 *****      forms.office.com  Block         Phishing & Fraud                           
                                           16/10/2017 11:17:39 *****      geo-um.btrll.com  Block         Spyware                                  
                                           16/10/2017 11:16:21 *****      o.aolcdn.com/ads/adchoices.pngBlock         Spyware       live.sport.co.uk

Hi MichaelMcLannahan 

Thanks for the details, will check about these sites and get back to you.

We are seeing the same thing out of the blue. The following domains are showing up as blocked. They all appear to be ad-serving domains, so I don't know that it's a bad thing, but it just started and we're seeing lots of them:

*.btrll.com

*.adsrvr.org

I am seeing the same thing this morning. It appears btrll is related to yahoo ad tracking.. I am seeing it all over the place. 

Here're some more sites.

Hi KAR AAR & Brian Rohllf

Please do DM the links in text format , which would help me in having it checked swiftly.

Hi KAR AAR & Brian Rohllf

Please do DM the links in text format , which would help me in having it checked swiftly.

++Gowtham Mani,

Please find below the sorted few sites list.

Date/time URL Action Reason Referring URL
16/10/2017 16:04 allied.direct.abl.com.pk Block Phishing & Fraud
16/10/2017 14:10 ci3.googleusercontent.com Block Phishing & Fraud
09/10/2017 10:07 dsf4t5jfds34j.com/1346346.css Block Phishing & Fraud mrelhlawany.com/pr/1774
09/10/2017 10:07 dsf4t5jfds34j.com/1346346.html Block Phishing & Fraud mrelhlawany.com/pr/1774
15/10/2017 23:15 js.bestquickcontentfiles.com/dl.min.js Block Phishing & Fraud check.theforeverlasting2upgrade.club
14/10/2017 9:59 lh6.googleusercontent.com Block Phishing & Fraud
15/10/2017 17:17 lh6.googleusercontent.com/-KU7jOCN-kUQ/AAAAAAAAAAI/AAAAAAAAABA/MODiIuk698c/s35-c/photo.jpg Block Phishing & Fraud pics2islam.blogspot.com/2010/12/blog-post_7799.html
16/10/2017 16:26 out.easycounter.com Block Phishing & Fraud
15/10/2017 17:40 r1.res.office365.com Block Phishing & Fraud
15/10/2017 23:16 www.yourreliablupgrades.bid/bl.php Block Phishing & Fraud linkshrink.net/7Yuysb
15/10/2017 14:26 www-01.ibm.com Block Phishing & Fraud
15/10/2017 14:24 www-01.ibm.com/support Block Phishing & Fraud
15/10/2017 14:48 www-01.ibm.com/support/docview.wss Block Phishing & Fraud
15/10/2017 10:15 www-01.ibm.com/support/search.wss Block Phishing & Fraud www-01.ibm.com/support/docview.wss

Latest web events Date/time User URL Action Reason Referring URL Reference ID
10/16/2017 9:12:19  use-tor.adsrvr.org    Block Spyware
10/16/2017 9:12:10 use-tor.adsrvr.org    Block Spyware
10/16/2017 9:00:32 use-tor.adsrvr.org    Block Spyware
10/16/2017 8:56:20 use-tor.adsrvr.org    Block Spyware
10/16/2017 8:54:33 use-tor.adsrvr.org    Block Spyware
10/16/2017 8:54:33 geo-um.btrll.com        Block Spyware
10/16/2017 8:54:29 use-tor.adsrvr.org    Block Spyware
10/16/2017 8:54:24 geo-um.btrll.com        Block Spyware
10/16/2017 8:53:25 o.aolcdn.com         Block Spyware
10/16/2017 8:53:18 o.aolcdn.com         Block Spyware

Hi Brian Rohllf & KAR AAR 

Thanks for the input ,we have already re-categorized few of the mentioned sites and working on the rest. I will keep the thread updated once all the reported sites are verified and sorted.

Note: It might up-to 2 hours for the changes to take effect.

These too please. This issue seems rooted at a higher level then re-categorization per domain. Also, this is from a user opening an email on OWA. Clicking a link inside the email won't let them in. But if they copy paste the URL in the browser they have access w/o issue. Please advise.

10/16/2017 1:57:31    download.bleepingcomputer.comBlock         Spyware                                   
                                           10/16/2017 1:52:38    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                           10/16/2017 1:52:26    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                           10/16/2017 1:52:19    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                           10/16/2017 1:51:27    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                           10/16/2017 1:48:55    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                           10/16/2017 1:47:54    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                           10/16/2017 1:44:58    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                           10/16/2017 1:40:02    nam04.safelinks.protection.outlook.com  Block         Spyware                                   
                                           10/16/2017 1:38:27    nam04.safelinks.protection.outlook.com  Block         Spyware

It looks like it stopped flagging these sites for a while, but has started up again this afternoon. Are these sites supposed to be blocked?