Block access to newly registered domains via web gateway cloud

[User20297056]

Hello, can we create a policy via web gateway cloud and physical proxy which would prevent users from accessing urls on domains that were newly registered (within the past 24 hours for example?).

[fw_mon]

Hello @User20297056 

yes, you need an access to WHOIS data via API, here is a community thread with an example ruleset: 

communitym.trellix.com/t5/Web-Gateway/Block-new-domain-names-for-period-of-time/m-p/464666

I wish McAfee/SkyHigh could include this feature in thier core product.

[Ibraham]

I think you can do a workaround as follow:

create a rule to block access to webseits with no reputation or no category.

Mostly, if the website is still new, it is still not categorised by Trellix and has no reputation rating.

However, you need to test this as it could create False-Positive blocking.

Regards

Ibrahim