Website Exclusions Not Working

[deanb1234]

Another recent issue.  Website exclusions are no longer working that was previously working.

Pics of an example

[KDawg]

I have research investigating the block to determine if this is still hosting malicious Phishing content.

If you are sure you trust this site and would like to exclude from being blocked further please use the following as a website exclusion.

*.ftpsllc.com

I have replicated the block in a test environment and was able to resolve with this exclusion.

Please let me know if you still have trouble with this in place.

[deanb1234]

Thanks Kevin.  I put the exception in just as you said 2 hours ago and it's still blocking it.  This is happening on a few sites on multiple computers.  Korean users are unable to get to www.trusbill.or.kr.  I've excluded it multiple different ways, including *.trusbill.or.kr and nothing.  The exclusions were working and then a few days ago they stopped. 

[deanb1234]

There was another thread on the same issue and the person was able to use IP addresses and that solved the issue, but unfortunately that doesn't work for my environment.  The sites are still being blocked.

Also that's not a valid solution if a site is load balanced and has multiple random IP's.

[djacobson]

I see this IP as no longer being on the list, are you still getting the block at all @deanb1234?

[deanb1234]

Yep,  I even put all of the machines in a group with Web Protection disabled and now their getting an error message about exploit protection blocking an exploit.  Also while working with Ron on the server issue he saw in the logs that web protection was still trying to turn on even though the policy was disabled.

This is happening to ALL the machines in Korea, but not on a test machine here in the states.

[djacobson]

Ohhh, exploit hit, ok, that's something different. Alright, stay with Ron on the server issue, your machine not receiving or processing their policies correctly is something that will need to be in the hands of dev, I imagine he's getting that going for you already?

For the exploit hit, I'll need some logs off a machine in question. Open an elevated CMD prompt as admin. Change the directory to C:\Program Files\Malwarebytes Endpoint Agent

• cd C:\Program Files\Malwarebytes Endpoint Agent

Once there, run this command

• MBCloudEA.exe –diag

That will create a folder on the desktop called MBDiagnostics. Send this zipped folder back to us.

Edited October 30, 2017 by djacobson

[deanb1234]

Thanks Dylan!

I've sent these instructions over to our International IT to reach the Korean office.  

What's really strange is that my test machine is able to access the site fine, but the entire Korean office is blocked from accessing it.  It will either throw the website block if web protection is enabled or the exploit block if it's disabled.  Very strange.