Create a Suspicious URL List

The Suspicious URL List is a group of URLs which are potentially a known threat. You can configure how the Gateway applies these, using a number of rules.

You can add a Suspicious URL List to a URLs and Hyperlinks clause in the What To Look For? section of a content rule.

Tell me about...

• Suspicious URL List Rules

  You can select any combination of rules to apply to a Suspicious URL List:

  • URLs containing an IP address instead of a hostname: for example, http://192.168.1/default.html

  • URLs containing encoded characters in the hostname: the hostname part of a URL containing percent encoded characters. For example, http://www.%63%6c%65%61%72%73%77%69%66%74.com

  • URLs containing authentication details: for example, ftp://username:password@address
  • URLs purporting to be secure that are not: URLs that attempt to deceive users into thinking it is using the secure HTTPS protocol when it is actually using the unsecure HTTP protocol. For example, http://https-securewebsite.org.
  • URLs to non-standard port numbers: a port number which is not expected for the given protocol of the URL. For example, http://www.clearswift.com:443 which has an HTTP URL attempting to connect on port 443 (which is usually used for HTTPS) rather than the expected port 80.
  • URLs to local files: any URL prefixed with file://...
  • URLs that contain (and possibly redirect to) other URLs: URLs that appear to contain another URL. Such URLs might be using a redirection service to hide the true destination from users. For example, http://saferedirectservice.com/?target=http%3a%2f%2fwww.malicioussite.net

How do I...

• Create a Suspicious URL List?

  1. From the Policy Center Home page, click URLs. The Manage URL Lists page is displayed.

  2. Click New adjacent to the URLs header. The Choose URL List Type? dialog is displayed.

     You can also click New URL in the What would you like to do? panel.

  3. Select Suspicious URL List and click Create.

  4. Use the Overview section to add a Name and optional Notes for the Custom URL List.

• Add a new URL to a URL List?

  You cannot add a URL to a Suspicious URL List. This list is managed dynamically by the Gateway. However, you can adapt the rules to configure how the list of Suspicious URLs is applied to your security policy.

• Adapt the Rules of a Suspicious URL List?

  You can select rules which determine how the Suspicious URL List is applied. In the Rules section, select the rules you want to apply or select All rules to apply them all by default.

  Click Save.

When you have finished modifying your content security policy you must apply the configuration for any changes to take effect. If the Gateways are configured as a group, any group changes should be applied to each Gateway.