Skip to main content
My preferencesSign out
Proofpoint, Inc.

Why malicious links are being re-written but not getting blocked? Or Why URL Defense is blocking not malicious links?

Situation
  • Customers are receiving emails with re-written links, but links take them to bad sites.
  • Customers complain that legit links are being blocked.
Solution This issue is same as False Negative or False Positive, and they are handled by an internal engineering team that work with us
  1. Search for the email in the logs and follow the reporting process.
  2. Get the permalink of the email, and the link(s) in question.
  3. You could chat or create a support ticket to help you with this issue.

 

How to report a link - URL Defense False Negative and URL Defense False Positive

Please note that only an 'Administrator' level account can report as a False Negative/Positive.

To clarify: 

  • False Negative - Emails with bad links not being blocked
  • False Positive - Emails with not malicous links getting blocked

Q. How to Report URL Defense FP/FN? 

As the admin, please do the following:

  1. Go to Log Search.
  2. Search for this message.
  3. Click the detail (FN)/View(FP).
  4. Press the Report as ... (False Negative /False Positive).
  5. Fill out the information on the next page.
  6. Submit.
  7. Copy the permalink of the message(s) being reported. 
  8. Once you do this, create a ticket or reply back to existing indicating you did this and supply the permalinks and link that is having the issue. Please, include in the ticket the link(s) that needs to be blocked or unblocked.

 Q. How long does it take? 

  • Because this issues are handled by another team called Spam and Threat Engineering, it can take up to 48 hours.
  • Normally they are resolved by the next day.

Q. What about the option: "Report As"? 

If you are using the drop down selection to report as:

  • You can only do this one at a time, you cannot mass select messages and report. This does not work.

clipboard_e7b1753e83f654ef925b18c66d7bb571d.png