FYI, file36.com (54.218.87.136) is listed as neutral (http://www.senderbase.org/lookup/?search_string=file36.com), hence the wsa will not prevent connections to that URL. The URL filtering functionality on the ESA does not appear to detect those suspicious links.