This article provides the following information:
- Reason why WRS have different responses when surfing internet sites using URLs or IP addresses
- Detailed description on how WRS works
- WRS score ranges
- Protocol that WRS uses
- Process to submit requests to reclassify specific sites
If a requested URL cannot be rated by a local database and memory cache search, then the Trend Micro URL Filtering Engine (TMUFE) will request a rating from the Trend Micro Rating Server via an HTTP request with an encrypted message.
TMUFE caches the response from the server to enhance the performance of the in-the-cloud query. Afterwards, TMUFE parses the results and fills then in the returning rating data structure. If the requested URL does not exist in the database, then WRS will return a score of "71" or "Unrated/Unknown" rating (61 before 3/26).
After receiving the rated score from TMUFE, the product will now take the following actions:
- Blocked: SCORE < Threshold
- Allowed: SCORE > Threshold
Web Reputation Scores
|Web Reputation Score||Safe Rating||Threat Details|
|81~100||Safe||No known or potential threats|
|66~80||Suspicious||Associated with spam or has a history of being compromised|
|51~65||Highly Suspicious||Possibly a phishing page or a potential source of malware or spyware|
|0~50||Dangerous||Possibly a phishing page or a potential source of malware or spyware|
|High||High setting does not block unrated pages unless the “Block pages that have been tested by Trend Micro” option is checked. This is tied up to when the previous option “Send queries to Smart Protection Servers” is unchecked. It also states in the information bubble that agents will not block untested sites if this option is checked.|
Blocks pages that are:
Verified to be fraudulent or known sources of threats
Considering that there are more than 35 million URLs in the WRS database, which are rated from machine analysis and human manipulation by different teams, it may be possible that there is a few URL rating errors.