AnsweredAssumed Answered

Application blocked but where is the application?

Question asked by Dan Roddy on Jun 28, 2018
Latest reply on Jul 2, 2018 by Charris Lappas

So there is this news web site in Portland, OR called www.wweek.com (Willamette Week) and as you can see here Application Control sees this site as an application that has been categorized as high risk.  Of course, we block this application category, but is it really an application? 

 

Application: wweek.com

Category: High Risk

Well let me take a look at my list of 7885 applications in R80.10 manager - NO, it is not there.  OK, so that is one discrepancy, next I say 'how did they get categorized as 'High Risk'?  I go to my trusty Checkpoint categorization/url filtering web site and I find they are in News/Media.  Now I go to my blocked categories group and look there but I do not find this category in that custom group that I have blocked.  Still digging now I go to Smart Logs and apply this filter 'app_category:"News / Media", run the query and walla! I find a collection of blocked 'News/Media' traffic on both port 80 and 443 including BBC - really! but no wweek.com in the last month (really, again).  OK, now I'm really digging deep and looking into 'Additional Categories' and I find Phishing,News / Media,High Risk,URL Filtering.  OK, now I am checking a half dozen blacklist sources to try to discover how/why this site is classified as High risk.  I cannot figure this out, HELP!

 

For http://wweek.com

Categories: News / Media

Category:
News / Media 

This category includes URLs that provide online news media such as International or regional news broadcasting and publication. Examples: http://www.cnn.com, http://www.nytimes.com, http://www.washingtonpost.com

 

 

Outcomes