Exchange ATP SafeLinks - Blocking sites not in the block list

[robert grahame]

We have an issue where ATP is blocking emailed links and giving the "This website has been classified as malicious." message, but the site is not on the block list, and we are not scanning downloads.

How can we (a) find out why it is doing this and (b) stop it doing it if the site is not malicious?

I'm pretty sure the ATP blocked links are clean - respected website, not blacklisted anywhere ever, scans with all the usual tools show up nothing, our main web content filter says the links are all OK (and that is usually pretty paranoid).

[#2]

Check safe links policies in Exchange online admin center. You may have modified the default policy, or created a new custom policy, maybe blocking "potentially malicious URLs"

https://docs.microsoft.com/en-us/office365/enterprise/advanced-threat-protection-for-your-office-365...

[#3]

We do indeed check against the list of potentially malicious URLs, and prevent clickthough, but the URLs being blocked are not in that list (even when I parse the wildcards to ensure it isn't matching a poorly written entry by accident). I can't figure out why they are being blocked. Most are fine, just this one set, all connected to a specific organisation (who publish transportation industry newsletters).

Odd!

[#4]

Please take into account that blocked URLs in the Default policy, are not the same as "Potentially malicious URLs" option that appears in custom policies (a different list of policies, at the bottom of the page). The latter uses URL Detonation, threat intelligence Technology:

https://blogs.office.com/en-us/2017/01/25/evolving-office-365-advanced-threat-protection-with-url-de...

In custom policies, you can block "Potentially malicious URLs" and then whitelist the URLs that you want.