Dealing with a web server that hosts multiple virtual hosts

[Ronald Nutter]

We are dealing with a problem where Senderbase is reporting a problem with an ip address that a particular FQDN that we are trying to access happens to be assigned.  My question is if I whitelist FQDN A that we are trying to access and someone just happens to use FQDN B, will the Ironport still catch the problem with FQDN B and allow FQDN A to work ?  I know that if FQDN A is compromised that we would be vulnerable to whatever the server has.

This is now the second time we have run into a problem with a web hosting company having multiple servers running on the same ip address and one of the servers being affected/infected and that causing a problem with getting to another host on that same server that isnt having a problem.  Has anyone else run into this same problem and how did you deal with this problem ?

Ron

[jowolfer]

Ron,

I think the answer to your question heavily lies on what aspect of the WSA is blocking your content. You mention senderbase, so I assume you're referring to WBRS. WBRS does provide information regarding FQDNs; it is not server specific, although it can be.

So even though site_a propogates malware and is hosted on the same server as site_b, they will have their own individual scores. It is also possible that the server itself will be blacklisted.

In these cases it's a really sticky situation. Customer's typically need to add the server they desire to a white list category, in order to get it working through the WSA, until the server's score is fixed.

Cheers,

Josh