topic Re: Suspected Credential Phishing Detected in General Topics

Suspected Credential Phishing Detected

BrianMacha — Mon, 17 Oct 2022 18:51:05 GMT

Hi!

Users connecting to our network via VPN receive "Suspected Credential Phishing Detected" when attempting to log into our in-house equipment reservation webpage. The URL filtering log indicates a blocked URL action on category "government". I've tried to adjust the group profile item in the associated rule for the "government" category from "block" to "continue" or "allow" but it doesn't seem to matter.

Any insight is welcome!

Thanks!

Re: Suspected Credential Phishing Detected

JayGolf — Mon, 17 Oct 2022 20:14:08 GMT

Hi @BrianMacha ,

Can you verify the category of your in-house website? I would go to Monitor -> Logs -> URL Filtering and find the traffic with the destination being the in-house website. Verify that the "credential theft detected" is set to yes and the category that is associated with it. Once the category is verified, you can go into the url filtering profile applied to your policy and set credential theft detection to not block the category associated with your in-house website.

If that doesn't work, you can enter the domain into a whitelist. Whitelisting the site will bypass URL-filtering thus not being checked for credentials.

Re: Suspected Credential Phishing Detected

BrianMacha — Mon, 17 Oct 2022 21:07:33 GMT

Thanks for the reply, Jay.

I'd like to add that users in-house/local are able to access the website without issue. The rule associated with in-house user access utilizes the same URL filtering profile as the rule that is utilized for the VPN users (except the VPN users are given the Suspected Credential... message). It is as if there's something beyond the the Actions|Profile Setting in the VPN rule that's overriding everything.

Another thing I noticed in the URL Filtering log is that "credential detected" is "no" and source user is blank for entries in which there is successful interaction with the website by in-house/local users. For VPN users, "credential detected" is "yes" and "source user" is occupied by the full username.

Thanks!

Re: Suspected Credential Phishing Detected

OtakarKlier — Tue, 18 Oct 2022 20:54:11 GMT

Hello,

If the website is internal to your company, eg inside your network. Do Not perform URL filtering.

Regards,

Re: Suspected Credential Phishing Detected

BrianMacha — Wed, 19 Oct 2022 13:33:57 GMT

I ended up whitelisting the site in the URL filtering profile.

Thanks for the help!

-Brian M.