Unexpected Redirection or Mismatched Content and When Accessing Sites via Cloud SWG

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

When users attempt to access a legitimate, trusted website through the Cloud Secure Web Gateway (Cloud SWG), they are automatically redirected to foreign e-commerce sites, gambling platforms, or other completely unexpected and unrelated web pages.

This behavior is typically specific to traffic routing through the SWG, while direct connections from local IP addresses might occasionally appear to display the normal website.

Cause

The target website, or its underlying hosting server/CMS (Content Management System), has been compromised by a malicious third party. The attackers have implemented a sophisticated technique known as "Cloaking."

• IP and Region-Based Conditional Routing: The malicious scripts injected into the server detect the visitor's source IP address, geographic region, User-Agent, or ISP.

• Why it triggers via Cloud SWG: Cloud SWGs often route traffic through data centers located in different regions or use specific IP ranges designated for cloud infrastructure. The cloaking script identifies these proxy/data center IPs or foreign regions and triggers the malicious redirect, whereas a local connection from a residential/standard corporate IP might bypass the filter and see the legitimate site. This is a deliberate tactic used by hackers to evade detection by the site's actual administrators.

 

 

Resolution

 

• Cease Immediate Access (Temporary Block) Users should immediately refrain from accessing the affected website. It is highly recommended to implement a temporary block or URL filtering rule within the Cloud SWG policy to prevent other employees from reaching the compromised site and risking secondary infections (e.g., drive-by downloads or phishing).

• Isolate and Document the Evidence Capture the specific source IPs of the SWG nodes being used, the full URL of the destination site, and the HTTP request/response headers if possible. This logs the exact conditions under which the cloaking occurs.

• Notify the Website Administrator Contact the administrator or the security team of the compromised website immediately. Provide them with the details of the unexpected redirection, highlighting that cloaking based on data center/foreign IPs is suspected, so they can audit their .htaccess, server configurations, and integrity files.