Compromised site and fake tech support not blocked y fortigate

Forum|Forum|6 years ago
January 22, 2020
6 replies
10020 views

Hi all,

We often see some of our users reporting the fake tech support scam.

Exemple of a compromised site here : page2rss.com

While the scam is hosted on cloud, and url may change, it looks like there is always the same url pattern :

"randomfirstpart".cloudfront.net/xxxch75xx88/"

(example : https://d378glj94x3qmi.cloudfront.net/xxxch75xx88/index.html)

1. How can i block url patterns with xxxchxx88 ?

2. Why isnt my fortigate able to protect me against that threat ? (it's always the local antivirus that does the job)

ty

tanr

New Member

Looks like that's one Fortinet hasn't properly categorized yet. You can report it from the FortiGate under (at least for 6.0) System, FortiGuard, Request re-evaluation of URL category.

Nicklebon

New Member

Don't blame the fgt for an improper policy. Block uncategorized websites. Will it create more work for you? Most certainly it will but, these things this should get blocked. It is near an impossible task to classify as they come up. So you can expect to see a lot sites. This will really scale up as we move into election season in the US as local political sites will start popping up all over the place.

Toshi_Esumi

SuperUser

For the original question 1), you can use Static URL Filter with regex. Or if all at cloudfront.net to be blocked, just use a simple filter "cloudfront.net". In case you want to use regex, be careful not block other legit URLs simply because there is a same pattern in the URL. If you use too short one like "ch.*88", it matches many others like "www.schwab.com/archive/1988/..".

Sign up

Login with SSO

Login to the community

Login with SSO