EMSX Body Domain/URL Detection

[mathisbilgi 0]

Hi All,

There is a phishing URL coming with a spam email. the url is hxxps://ssde345sdfgyju.ru . I see that ESET Endpoint Security web filter detects the URL as malicious but the spam email that contains the URL classified as Clean by EMSX. Does EMSX not check URL in mail body against blacklist? Is that possible?

I have checked common things.

EMSX database updated. Livegrid and EDTD is accesible. I have confirmed the email scanned by EMSX.

[Marcos 5,074]

The domain is not blacklisted. If the email was not evaluated as spam, you can send it in the eml or msg format to spam[at]eset.com. You can also upload it here for me to check it out.