cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
667
Views
0
Helpful
1
Replies

WSA L4TM and scorecardresearch.com

DCS NSO
Level 1
Level 1

Good morning!

So we're running reports on a daily basis to gather information on our environment and have recently enabled L4 detections on our Ironport WSA's. I have noticed an extremely large number of detections for the domain "scorecardresearch.com" - Given I've only enabled in monitor mode to see what it would pick up, does anyone else have any additional information on this domain and possible data that may indicate that this is a false positive or in fact something that should be blocked?

In a week we've had 104.7k detections for this domain with a userbase of roughly 5,000 with internet access.

From information I've found, they collect data using cookies and surveys, this includes;

  • when your browser visited a website
  • what page of the website it was
  • the title of the web page
  • IP address

TLDR; Do you have massive hits on scorecardresearch.com through L4TM and if so, do you specifically block it.

Cheers

Brodie

1 Reply 1

Erik Kaiser
Cisco Employee
Cisco Employee

Hi Brodie,

I to have looked up the URL in question and found similar information reagrding scorecardsearch.com. It very well could be a false positive. If you would like please open a case with our WSA TAC team and we can submit this for evaluation to determine if its a false positive or not.

Sincerely,

Erik Kaiser
WSA CSE
WSA Cisco Forums Moderator

Sincerely, Erik Kaiser WSA CSE WSA Cisco Forums Moderator