Entry Accuracy Counts

It is important to enter the URL as accurately and simply as possible – this helps us reclassify and get back to you with an updated solution as quickly as possible:

• No need to enter leading http://
• No need to enter leading www.
• http::/yoursite.com may get a classification review, but our automated system will not be able to respond to you if there is a typo in the URL entry.
• Extraneous leading spaces or tabs are also problematic: " yoursite.com"
• There is no need to enter all the URL variations. Just one generic example will do.

We're not ignoring you

If we get the web site reclassified before we process your request, you may get back an "already in best Webroot category" response. We're not ignoring you; it's just that we've already taken care of this site. You can always use the Webroot's Test-A-Site capability if you suspect this is the case:
http://www.brightcloud.com/tools/url-ip-lookup.php
You may also get this message if you submit the same or very similar suggestion twice, or if we cannot resolve the web site that you send to us because the site is down or the page is missing or unavailable, or we do not have permission to access the site or page.

Single Category implementations

Some of our partners' implementations are limited to a single Category per web site. In this case, they have to choose the most relevant category, and they may not always agree with what you would have chosen as the "best" category.

Integration field may be used for notes to us

If you want to send us a short note on the classification problem, feel free to use the "What integration are you using" field for that purpose.

IP Addresses

IP Address classifications may cause problems because multiple sites may be hosted on a single IP, and Webroot's service may find questionable content and good content on the same IP. When asked to reclassify by IP, we have an analysis process that determines which web sites contributed to the classification and if any of them should be changed. This normally takes us a bit longer than classification of URLs, and sometimes we reply initially with an "already in best category" message, even though we are doing the work behind the scenes.

URLs with arguments and query strings, and other issues

In order to evaluate a site, we must be able to "see what you see" in your browser. Secure HTTPS sites, cookies, geographic locales, URL arguments and query strings can make that difficult. Whenever possible, it is best to send us URLs in the simplest possible form.

How Long Will This Take?

Our Web Analysts typically process all requests within 24 - 48 hours after they are received. If you check the Receive Notifications box on the request page, you will receive two emails from us - the first acknowledging that we received your request, and the second after it has been processed and updates published to our systems. There may be an additional delay in receiving your data updates depending on how frequently your specific product gets updates from BrightCloud. Additionally, Palo Alto Networks customers may have to do a "cache flush" for their change to take effect.

Why are you still blocking my URL?

BrightCloud does not block sites, we only classify them. Your security device (firewall or software) has policy settings that control which URL categories are allowed or blocked; you may need to speak to your IT administrator about your organization's policy to block certain categories or make an exception for a specific URL. Also, some of our integration partners may require a cache flush after we make a category change for it to take effect on your local device. For example, Palo Alto Network devices require the command "clear url-cache all" to clear the cache.

Webroot Reputation Change FAQ

Reputation as defined and calculated by Webroot is predictive security - sites that are currently infected with Malware or compromised will have low Reputation scores, but so will sites that have exhibited behaviors that make them likely to be security risks in the future. In this way, Webroot protects our users from "zero day" risks.

Why does a new web site have a low Reputation score?

We often field requests from customers who ask why a new site has a low Reputation score. The reason is that, after being trained on millions of good and bad websites, site "newness" (Age) has been determined - by the MED Machine Learning algorithm - to be a highly weighted and negative determinant of risk. Of the hundreds of thousands of new web sites created every day, a large percentage are plain "junk" - they are Parked or Spamvertised sites. More dangerously, a significant number of them are Malware, Phishing, Adware or Spyware. A very small number are actually legitimate new web sites.

My site was infected with Malware a day / week / month ago, but it is clean now, please give it a high reputation score.

Again, the MED has determined the right "decay time" for sites that were infected with Malware or some other security problem, and the current Reputation score takes that into account. Over time, if the site maintains a clean track record, the Reputation score will improve based on the learning of the MED algorithm and model.

While we have the ability to "whitelist" Reputation scores for sites, we prefer not to do that as it ignores the cumulative security survey of millions of websites. The analogy with a person's FICO score is appropriate - if a person has no credit experience, they have a lower credit score. If a person has a past history of default on payment or bankruptcy, they also merit a lower credit score. The way a person builds up their credit score is to create a clean credit history, which will improve their credit score over time.

How Long Will This Take?

Our Web Analysts typically process all requests within 24 - 48 hours after they are received. If you check the Receive Notifications box on the request page, you will receive two emails from us - the first acknowledging that we received your request, and the second after it has been processed and updates published to our systems. There may be an additional delay in receiving your data updates depending on how frequently your specific product gets updates from BrightCloud. Additionally, Palo Alto Networks customers may have to do a "cache flush" for their change to take effect.

Webroot IP Reputation Change FAQ

How Long Will This Take?

Our Web Analysts typically process all requests within 24 - 48 hours after they are received. If you check the Receive Notifications box on the request page, you will receive two emails from us - the first acknowledging that we received your request, and the second after it has been processed and updates published to our systems. There may be an additional delay in receiving your data updates depending on how frequently your specific product gets updates from BrightCloud. Additionally, Palo Alto Networks customers may have to do a "cache flush" for their change to take effect.

Associated Threats

Windows Exploits

The Windows Exploits category includes active IP addresses offering or distributing malware, shell code, rootkits, worms or viruses.

Web Attacks

The Web Attacks category includes cross site scripting, iFrame injection, SQL injection, cross domain injection, or domain password brute force attack.

Botnets

The Botnets category includes Botnet C&C channels, and infected zombie machines controlled by Bot master.

Scanners

The Scanners category includes all reconnaissance such as probes, host scan, domain scan, and password brute force attack.

Denial of Service

The Denial of Service category includes DOS, DDOS, anomalous sync flood, and anomalous traffic detection.

Reputation

The Reputation category denies access from IP addresses currently known to be infected with malware. This category also includes IPs with average low Webroot Reputation Index score. Enabling this category will prevent access from sources identified to contact malware distribution points.

Phishing

The Phishing category includes IP addresses hosting phishing sites and other kinds of fraud activities such as ad click fraud or gaming fraud.

Proxy

The Proxy category includes IP addresses providing proxy services.

Spam Sources

The Spam Sources category includes tunneling spam messages through a proxy, anomalous SMTP activities, and forum spam activities.

Webroot's full IP threat category descriptions are provided below.

Spam Sources

Spam Sources includes Tunneling Spam messages through proxy, anomalous SMTP activities, Forum Spam activities.

Windows Exploits

Windows exploit category includes active IP Address offering or distributing malware, shell code, rootkits, worms or viruses

Web Attacks

Web attacks category includes cross site scripting, iFrame injection, SQL injection, cross domain injection, or domain password brute force attack

Botnets

Botnet category includes Botnet C&C channels, and infected zombie machine controlled by Bot master

Scanners

Scanners category includes all reconnaissance such as probes, host scan, domain scan and password brute force attack

Denial of Service

Denial of Services category includes DOS, DDOS, anomalous sync flood, anomalous traffic detection

Reputation

Deny access from IP addresses currently known to be infected with malware. This category also includes IPs with average low Webroot Reputation Index score. Enabling this category will prevent access from sources identified to contact malware distribution points

Phishing

Phishing category includes IP addresses hosting phishing sites, other kind of fraud activities such as Ad Click Fraud or Gaming fraud

Proxy

Proxy category includes IP addresses providing proxy and def services.

Mobile Threats

Mobile Threat category includes IP addresses of malicious and unwanted mobile applications. This category leverages data from Webroot mobile threat research team.

Tor Proxy

Tor proxy category includes IP addresses acting as exit nodes for the Tor Network. Exit nodes are the last point along the proxy chain and make a direct connection to the originator’s intended destination.