Warnings and false positives

This page explains what the extension does when it blocks a page, what options the user has and how to handle a false positive. It is for whoever uses Phishing Shield and whoever administers it.

The warning page

When the extension decides to block a page, it replaces it with the Website blocked screen, which shows:

• Blocked site screenshot: a screenshot of the blocked page, so the user can recognize it.
• Blocked URL: the blocked address.
• Tags with the type of attack detected, for example Reverse Proxy AITM or Content cloning.
• Block reason: an explanation of why the page was blocked.
• Full security analysis: the result of each check (homoglyphs, typosquatting, phishing and IP databases, VNC, AiTM, cloning, QR and ClickFix).

You can see this screen in How it works. The actions are below it:

Action	What it does
Close tab	Closes the tab. This is the recommended option
Report false positive	Sends the block for review. Use it if you think the page is legitimate
Continue at my own risk	Allows the page for 30 minutes in that browser. The exception disappears when the browser is closed

The report includes a screenshot of the blocked page, a snippet of its HTML without form data and the block details. See Privacy and permissions.

Note

Depending on your company’s settings, Continue at my own risk may not be available.

When there is only a medium risk, the extension shows a system notification and does not block. See Detection engines.

The extension window

The extension icon in the browser toolbar opens a window with three tabs:

1. A main tab with the global switch (if your company allows the extension to be turned off), license status, status of the phishing and malicious IP databases, custom domains and temporary exceptions.
2. A statistics tab: blocks per day, week and month, breakdown by type and most frequent domains.
3. A history tab: search, filters and CSV export of recent blocks.

False positives

A false positive is a legitimate page that the extension blocks or warns about by mistake. The extension reduces the risk with several filters:

• Trusted domains. Before applying the checks, it consults a database of more than one million trusted domains.
• Protected domains. A managed list of legitimate domains, global and per company, stops weak signals from blocking. Strong signals still block: an organization’s own domain can also be compromised.
• Lookalike domains. A name that resembles a brand is not enough to block: the page must also imitate that brand.
• Third-party sign-in pages. A page with several “Continue with…” buttons is treated as a third-party sign-in and not as a clone.
• Text versus code. ClickFix and VNC only trigger on executable code, not on text that describes the attack.

Your organization’s domains

Add your organization’s domains in the Phishing Shield admin console, under Custom Domains. The extension uses them in two ways:

• As trusted domains: weak signals no longer block their pages.
• As brands to protect: it detects domains that imitate them, even if your brand is not on the default list of protected brands.

Each user can also add custom domains from the extension window.

What to do when a legitimate page is blocked

1. On the warning, click Report false positive so the block is reviewed.
2. If you need to get in now and your company allows it, click Continue at my own risk: the page is allowed for 30 minutes.
3. If it is one of your organization’s pages, add its domain under Custom Domains in the admin console.
4. If the problem keeps happening, contact support and include the address, the time and the reason the warning shows.

More information

• How it works
• Deploy in your organization