Hi,
I have implemented Cisco security proxy rewritting for some of links present in incomming messages of my Cisco ESA.
Some of these links are declared "safe" but there are clearly phishing email.
Exemple of webpage in attachement
The user is directly on a fake sign windows ...
I don't understand why Cisco security proxy does not detect the trap...
I have already contact Cisco support with this type of problem (on an other link), the only answer was that the case is transmitted to Talos for recategorization. It is not a problem of categorization, it is a sandbox effiency problem.
Regards,
Guillaume
