Webpage blocked: Information for One.com users

[Pilmolt]

Hi everybody,

I'm webmaster. I've the same probleme with a lot of sites by One.

See the answer of One :

It currently has a problem with the software AVAST anti-virus, which has blocked our IP address
Our technical team has already contacted Avast and ask them to unblock the situation because it seems that Avast has blocked one of our IP address.   We can not tell you exactly when the problem will be completely resolved because it depends Avast. This could take hours or a few days.


I have any problems with old sites (more than 3 months)

Some examples  :
http://www.bptrident.be/site/01-presentation.htm
http://www.renovart.be/
http://www.delphigraph.be/
http://www.wproconstruct.be/
http://www.bastinconstruct.be/
.....

My question : is this info correct or not ?

Thanks.

[polonus]

Hi Pilmolt,

If there is a network shield block for a particular IP with thousands of domain names assigned to it, one could easily land in such a situation.
There are some issues with several domains on this IP that the hoster has not handled and are known to be with status LONG OVERDUE.
IP has also some flagged and verified PHISH sites.
That is why sites owners are advised to change hosting. Well at leat this was advised by one of the avast team members.
There are issues to be blocked see: http://www.google.com/safebrowsing/diagnostic?site=AS:51468&hl=en
3 urls are being blacklisted on that AS for being malicious URLs, having badware, having exploit servers and current events going on...

polonus

[polonus]

One could easily imagine the IP block problem going here: http://sameid.net/id/46.30.211.55/
So this should be blocked at the moment by avast: wXw.haarby-karosseri.dk and we'll find it is actually being blocked as containing URL:Mal

pol

[massico]

14746 websites with IP 46.30.211.55 

[godest]

changing host is out of the question, silly if that has to be the solution tbh.

[polonus]

No of course that should not be the solution.
The hoster should remove long overdue malware launching sites and close down malcode or make that malware goes dead on their AS.
If that should be the case there is no reason for blocking.
One cannot have the best of two worlds,

polonus

[polonus]

Avast is not the only one to block: http://pastebin.com/Mqmp5vf5

polonus

[massico]

Here the answer from one.com ( sorry it's in french).

Merci d'avoir contacté One.com

On a en ce moment un problème avec le logiciel d'anti-virus AVAST, qui a
bloqué notre adresse IP.

Veuillez noter que si vous utilisez Avast, notre équipe technique a déjà
contacté Avast pour leur demander de débloquer la situation.

On ne pourra pas vous dire exactement quand le problème sera
completement résolu car cela dépends de Avast. Cela pourra prendre des
heures ou quelque jours.

Merci de votre compréhension.
Bien cordialement

[godest]

Well i just hope Avast sorts this out quickly else im changing software. Kinda hillarious and sad at the same time that it flags plain old html code O.o
What did the message say? sorry i dont speak french

[massico]

The message says they have contacted Avast and one.com is waiting an answer in the next hours or days...

[polonus]

Hi godest,

Your certainly turning tables here...
But what about a hoster that has 14,746 (nearly 15 thousand that is) different sites hosted on one single IP!!!!
And it is not only avast that is blocking single IPs.
How could you defend such practices? Cheap hosting must come at a price..

polonus

[TPCR]

I am the owner of http://www.torfaenpcrepair.com which is also hosted by one.com

Here is the convo I had with the One.com advisor Elexis

Welcome to the One.com chat support. We are doing our best to answer your queries soon. We kindly ask for your understanding that our answers may be delayed during busy periods.
You are now chatting with 'Elexis'
Elexis: Thank you for using One.com 24/7 Interactive Online Support. My name is Elexis. How may I assist you?
you: Hi Elexis
Elexis: Hi! How can I help you today?
you: I was wondering if you could please check my site torfaenpcrepair.com as it was just flagged by Avast antivirus as a malicious site, and help me diagnose why it would be flagged
you: a screenshot can be seen @ http://postimg.org/image/egujdv8vj/
Elexis: "Since last night we had cases wherein clients who are using Avast as Antivirus are getting errors when visiting their website or domains hosted with us.
Elexis: This is already being checked and investigated...
you: I have run a malwarebytes scan and you have confirmed my suspicions that it is an issue with Avast
Elexis: yes they are blocking some of our ip adresses
you: have any of the affected IP adresses been changed recently or are they static adresses
Elexis: static addresses
you: Strange why they are targeting certain IP adresses
Elexis: i agree
Elexis: that a bit odd \
you: I scanned my backup files with both Avast and malwarebytes and they havent found anything
you: 23/03/2013 16:23:52 mbam-log-2013-03-23 (16-23-52).txt Scan type: Custom scan (C:\Users\TPCR1\Documents\torfaenpcrepair backup|) Scan options enabled: File System | Heuristics/Shuriken | PUP | PUM Scan options disabled: Memory | Startup | Registry | Heuristics/Extra | P2P Objects scanned: 7588 Time elapsed: 6 minute(s), 39 second(s)
Elexis: you are not the only ones affected by ths we have been receiving this from other custmers
Elexis: even if they do not have any files on their webspace
you: Even more strange, and does not make sense
Elexis: I Agree. we will be sending out updates on this once resolved
you: do you now if Avast has been alerted to the issue
you: I already sent a false positive report in but that could take time as it depens on their workload
Elexis: yes they have been alerted by this since we started getting reports
Elexis: our techs are working with them
you: Thank you

Here is a screenshot of the issue



I hope this gets resolved quickly

[Flippy]

Hello,

it was false detection and we highly apologize for it. It should be unblocked in next update. But some of websites on your IP is infected few of them is listed here: http://www.scumware.org/report/46.30.211.55

Again sorry for any inconvenience.

Filip Chytry
Malware analyst 

[TPCR]

Can you advise how long the next update will take please

[Pilmolt]

No problem more with my sites 

http://www.bptrident.be/site/01-presentation.htm
http://www.renovart.be/
http://www.delphigraph.be/
http://www.wproconstruct.be/
http://www.bastinconstruct.be/