Block "Totally Science" Challenge

[MrBryce2000]

OK, everyone, I have a bit of a challenge. The WebFilter app is amazing, and has allowed me to be creative in blocking sites that are intent on bypassing school filters.

This one is another challenge. It's called "Totally Science", but it has nothing to do with academics, it is all online games. It even has a keyboard shortcut that students can press to make the screen look like it is science homework if a teacher approaches. It also boldly claims that it can't be blocked by school filters. OK, challenge accepted.

Here is the main website: https://tsmain.co/

I have to admit that this site is clever for what it's doing, but the creators have crossed the line with me, and now it's on.

So, I have been thinking through on how I can build a rule to automatically block all of these current and future sites. One common variable is that the site title and site name for all of these sites is "Totally Science". I know that those variables can be changed, but can a rule be created in Web Filter to scan for those variables?

Oh, and I almost forgot, even Untangle's category lookup lists these websites as either unknown or educational. Yeah...right. Yes, I have already started submitting category change requests, but we'll see if that happens.

I also know that some people may want to reply saying to not worry about it, these are only harmless games. Well, you know that it doesn't take much for sites likes these to no longer be harmless.

[dashpuppy]

OK, everyone, I have a bit of a challenge. The WebFilter app is amazing, and has allowed me to be creative in blocking sites that are intent on bypassing school filters.

This one is another challenge. It's called "Totally Science", but it has nothing to do with academics, it is all online games. It even has a keyboard shortcut that students can press to make the screen look like it is science homework if a teacher approaches. It also boldly claims that it can't be blocked by school filters. OK, challenge accepted.

Here is the main website: https://tsmain.co/

I have to admit that this site is clever for what it's doing, but the creators have crossed the line with me, and now it's on.

So, I have been thinking through on how I can build a rule to automatically block all of these current and future sites. One common variable is that the site title and site name for all of these sites is "Totally Science". I know that those variables can be changed, but can a rule be created in Web Filter to scan for those variables?

Oh, and I almost forgot, even Untangle's category lookup lists these websites as either unknown or educational. Yeah...right. Yes, I have already started submitting category change requests, but we'll see if that happens.

I also know that some people may want to reply saying to not worry about it, these are only harmless games. Well, you know that it doesn't take much for sites likes these to no longer be harmless.

So what you are asking is how to bypass a system that is in place for a reason ? or did i read this wrong ?

[MrBryce2000]

So what you are asking is how to bypass a system that is in place for a reason ? or did i read this wrong ?

No, I am working to block a website that claims to be academic, but it is not. If you go to the website I linked to you will see the description that makes this more challenging than simply adding it to the "Block sites" tab. Here is a screenshot of the rules I have added, but I'm not yet sure if they work (haven't had a chance to test them yet).
Screenshot 2022-02-02 145453.jpg

[sky-knight]

He wants Webfilter to actually block these pages correctly. The only way to get that updated is to report all the links to Brightcloud.

The domains listed on the site can be added to the site block list too. The aggregate sight has poor reputation too, so Threat Prevention might be able to snag it if you want it to be aggressive.

Brightcloud is pretty good at looking at submissions, fill in the form and educate them. They'll respond.

[MrBryce2000]

He wants Webfilter to actually block these pages correctly. The only way to get that updated is to report all the links to Brightcloud.

The domains listed on the site can be added to the site block list too. The aggregate sight has poor reputation too, so Threat Prevention might be able to snag it if you want it to be aggressive.

Brightcloud is pretty good at looking at submissions, fill in the form and educate them. They'll respond.

Sky-knight, thank you. That was the type of "out-of-the-box" thinking that I needed. I'm new to using Threat Prevention, so I was only thinking of Web filter, Application control and SSL Inspector to make this happen.

This website is like a Medusa, where additional domains could be created quickly when the others have been manually blocked, but this is a start.

[dashpuppy]

No, I am working to block a website that claims to be academic, but it is not. If you go to the website I linked to you will see the description that makes this more challenging than simply adding it to the "Block sites" tab. Here is a screenshot of the rules I have added, but I'm not yet sure if they work (haven't had a chance to test them yet).
Screenshot 2022-02-02 145453.jpg

Yeah i didn't click the link, i don't have a safe browser at my finger tips. I don't just clink links on line these days

[sky-knight]

CAUTION:This email originated from outside of the organization.

Hello again -
We have reviewed hxxps://totallyscience[.]github[.]io/, and although we did not take your suggestion exactly, we have updated the site to the Games categories. This change is now published in the BrightCloud Service and is available in Database version 8.147.
Thanks again for your suggestion!
- Webroot BrightCloud Threat Intelligence Support
Questions? Suggestions? Need help? Contact us at: wr-dbchange@opentext.com

Hello again -
We have reviewed hxxps://tsmain[.]co/, and although we did not take your suggestion exactly, we have updated the site to the Games categories. This change is now published in the BrightCloud Service and is available in Database version 8.147.
Thanks again for your suggestion!
- Webroot BrightCloud Threat Intelligence Support
Questions? Suggestions? Need help? Contact us at: wr-dbchange@opentext.com

That took about 4 hours, and I only submitted the two domains. Both domains are now categorized as gaming sites, to do the rest go here: https://www.brightcloud.com/tools/url-ip-lookup.php lookup the URL, and fill in the form.

Brightcloud really is quite good at this stuff.