Legitimate email blocked by Email Security.cloud due to Web.Reputation.3 detection

Products

• Email Security.cloud

Issue/Introduction

Legitimate business emails are sometimes blocked by the Anti-Malware service in Email Security.cloud. These detections often present as Web.Reputation.3, indicating that a URL or domain within the email body has a poor reputation in the Symantec intelligence database.

Environment

• Product: Email Security.cloud
• Service: Anti-Malware

Cause

The Anti-Malware engine triggers a Web.Reputation.3 (High Intensity Detection) when a link within the message is categorized as a security risk, such as Malicious Sources/Malnets, by the Symantec WebPulse system.

Resolution

To resolve this detection and allow future emails, the triggering URL must be re-evaluated:

1. Identify the URL causing the block using Track and Trace logs or by reviewing the message content.
2. Navigate to the Symantec Site Review portal.
3. Enter the URL and select Check Category.
4. If the categorization is incorrect (e.g., marked as a Security Risk), select Request a Review.
5. Provide a justification for the change and submit.
6. Once the site is re-categorized to a benign category (e.g., Business/Economy), the email will no longer be blocked.

Additional Information

Contact Broadcom support for additional information or question related to detection.