Troubleshooting Tip: URL re-written but user able to access malicious website

To troubleshoot this scenario, check if these two different protection mechanisms are enabled:

1. Content Disarm and Reconstruction.
   
2. URL click protection.
   
   

For (1), check Profile -> Content -> Content -> 'CF_Inbound' content profile, as in Figure 1. This settings aim to sanitize email that contains hyperlinks and scripts, including in attachments, in order to reduce risk of spam, malware, and tracking.

Figure 1: Content disarm and reconstruction.

In this case, HTML content are modified using the following settings 'Redirect to Click Protection'. This means that if the user selects the URL, it scans the URL and then performs the click protection action configured in (2). 

When configuring the content profiles (as in (1)), choose what to do with the URLs contained in the email messages: either remove them or leave them. However, if the URLs are not removed, there is a chance that email users may open and follow them. To protect users from harmful or spam URLs, such as phishing or advertising web sites, FortiMail uses FortiGuard URL filter service and FortiSandbox to scan the URLs after the users open the URLs.

Depending on the inspection results from FortiGuard and FortiSandbox, decide if users should be allowed to access the URLs or block them.

For checking (2) mechanism, verify Security -> Disarm & Reconstruction -> URL configuration (in Figure 2), FortiMail rewrites any URLs in the email body that were categorized as unrated to point to itself (rewritten URL will point to FortiMail itself), as in following image:

Figure 2: URL click protection.

When the user opens the email URL at a later time, the URL request goes through FortiMail for a second rating query. If the URL rating changes from unrated to a malicious rating, FortiMail is then able to block the request.

If the rating is not changed, the request will succeed.

In conclusion, if a URL is re-written in the delivered email but the user is able to access the website upon opening it: this means that the first time the mail has been delivered mechanism (1) did not work because the URL was not rated as malicious. According to configuration (2), the URL has been rewritten with an URL that points to FortiMail. So, when the user opens it, traffic passes through FortiMail second time. This because FortiMail reserve to do a second rating check. In that case, the rating was still non-malicious and the user was able to load the page.

Example logs where the URL rating was not changed even after 20 minutes and FortiMail kept it blocked:

Related documents:

• Configuring content disarming and reconstruction 
• Configuring content action profiles 
• FortiMail / Using URL Removal and Click Protection (Fortinet Support Forum)