If a requested URL cannot be rated by a local database and memory cache search, then the Trend Micro URL Filtering Engine (TMUFE) will request a rating from the Trend Micro Rating Server via an HTTP request with an encrypted message.
TMUFE caches the response from the server to enhance the performance of the in-the-cloud query. Afterwards, TMUFE parses the results and fills then in the returning rating data structure. If the requested URL does not exist in the database, then WRS will return a score of "71" or "Unrated/Unknown" rating (61 before 3/26).
After receiving the rated score from TMUFE, the product will now take the following actions:
- Blocked: SCORE < Threshold
- Allowed: SCORE > Threshold
Web Reputation Scores
| Web Reputation Score | Safe Rating | Threat Details |
|---|---|---|
| 81~100 | Safe | No known or potential threats |
| 66~80 | Suspicious | Associated with spam or has a history of being compromised |
| 51~65 | Highly Suspicious | Possibly a phishing page or a potential source of malware or spyware |
| 0~50 | Dangerous | Possibly a phishing page or a potential source of malware or spyware |
| 71 | Untested | Unrated page |
| Security Setting | Description |
|---|---|
| High | High setting does not block unrated pages unless the “Block pages that have been tested by Trend Micro” option is checked. This is tied up to when the previous option “Send queries to Smart Protection Servers” is unchecked. It also states in the information bubble that agents will not block untested sites if this option is checked. |
| Medium | Blocks pages that are:
|
| Low | Verified to be fraudulent or known sources of threats |
Considering that there are more than 35 million URLs in the WRS database, which are rated from machine analysis and human manipulation by different teams, it may be possible that there is a few URL rating errors.