Author Topic: How to remove my website from your blacklist?  (Read 193481 times)

0 Members and 1 Guest are viewing this topic.

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1131
Re: How to remove my website from your blacklist?
« Reply #195 on: July 09, 2016, 08:07:45 AM »
The "hitsk.in" was a false positive, and was fixed a couple of hours after the detection was released. Everything should be okay now. If your users are still seeing popups, advise them to update Avast ;)
« Last Edit: July 09, 2016, 06:33:54 PM by HonzaZ »

Offline Nr_

  • Newbie
  • *
  • Posts: 4
Re: How to remove my website from your blacklist?
« Reply #196 on: July 09, 2016, 09:44:02 AM »
Will do. Thanks.

Offline chowkaideng

  • Newbie
  • *
  • Posts: 2
Re: How to remove my website from your blacklist?
« Reply #197 on: July 12, 2016, 07:08:25 AM »
Hi! One of my clients has his URL http://ambit.com.mx blacklisted by Avast. We have reported it as false positive several times, but always keeps being blocked. Right now we are also using Cloudflare.
What should we do in order to remove the URL from this black list?

I've scanned it with VirusTotal and other tools, and seems to be clear:
https://www.virustotal.com/en/url/1a6caf38607c4d7ddac15120b1175fb6e4c35f311c7884022dfffa9dbcf56b0d/analysis/

Thanks a lot in advance!
Dan
« Last Edit: July 12, 2016, 07:15:19 AM by chowkaideng »

Offline Asyn

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 66715
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Win 8.1 [x64] - Avast PremSec 20.8.2427.B#2 [UI.560] - CC 5.71 - EEK - FF ESR 68.12 [NS/AOS/uBO/PB] - TB 68.12 - SB/CP/SL/DU.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 32687
  • malware fighter
Re: How to remove my website from your blacklist?
« Reply #199 on: July 12, 2016, 06:28:53 PM »
Cannot see the site is blocked by avast nor flagged by AOS!
What you are seeing below is content generated by Incapsula not actual content from your site. Incapsula is blocking you from scanning your own site!
https://aw-snap.info/file-viewer/?tgt=http%3A%2F%2Fambit.com.mx%2F&ref_sel=GSP2&ua_sel=ff&fs=1
5 issues here: https://mxtoolbox.com/domain/ambit.com.mx/
Checking for cloaking
There is a difference of 6 bytes between the version of the page you serve to Chrome and the version you serve to GoogleBot. This probably means some code is running on your site that's trying to hide from browsers but make Google think there's something else on the page. show.
Code: [Select]
var z="";var b="7472797B766172207868723B76617220743D6E6577204461746528292E67657454696D6528293B766172207374617475733D227374617274223B7661722074696D696E673D6E65772041727261792833293B77696E646F772E6F6E756E6C6F61643D66756E6374696F6E28297B74696D696E675B325D3D22723A222B286E6577204461746528292E67657454696D6528292D74293B646F63756D656E742E637265617465456C656D656E742822696D6722292E7372633D222F5F496E63617073756C615F5265736F757263653F4553324C555243543D363726743D373826643D222B656E636F6465555249436F6D706F6E656E74287374617475732B222028222B74696D696E672E6A6F696E28292B222922297D3B69662877696E646F772E584D4C4874747052657175657374297B7868723D6E657720584D4C48747470526571756573747D656C73657B7868723D6E657720416374697665584F626A65637428224D6963726F736F66742E584D4C4854545022297D7868722E6F6E726561647973746174656368616E67653D66756E6374696F6E28297B737769746368287868722E72656164795374617465297B6361736520303A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2072657175657374206E6F7420696E697469616C697A656420223B627265616B3B6361736520313A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2073657276657220636F6E6E656374696F6E2065737461626C6973686564223B627265616B3B6361736520323A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2072657175657374207265636569766564223B627265616B3B6361736520333A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2070726F63657373696E672072657175657374223B627265616B3B6361736520343A7374617475733D22636F6D706C657465223B74696D696E675B315D3D22633A222B286E6577204461746528292E67657454696D6528292D74293B6966287868722E7374617475733D3D323030297B706172656E742E6C6F636174696F6E2E72656C6F616428297D627265616B7D7D3B74696D696E675B305D3D22733A222B286E6577204461746528292E67657454696D6528292D74293B7868722E6F70656E2822474554222C222F5F496E63617073756C615F5265736F757263653F535748414E45444C3D3837303134333132313538363435373030302C3434383439363830393830333130313834332C373535323532393437313138393835313037372C3331343939222C66616C7365293B7868722E73656E64286E756C6C297D63617463682863297B7374617475732B3D6E6577204461746528292E67657454696D6528292D742B2220696E6361705F6578633A20222B633B646F63756D656E742E637265617465456C656D656E742822696D6722292E7372633D222F5F496E63617073756C615F5265736F757263653F4553324C555243543D363726743D373826643D222B656E636F6465555249436F6D706F6E656E74287374617475732B222028222B74696D696E672E6A6F696E28292B222922297D3B";for (var i=0;i<b.length;i+=2){z=z+parseInt(b.substring(i, i+2), 16)+",";}z = z.substring(0,z.length-1); eval(eval('String.fromCharCode('+z+')'));})();
var z="";var
Code: [Select]
b="7472797B766172207868723B76617220743D6E6577204461746528292E67657454696D6528293B766172207374617475733D227374617274223B7661722074696D696E673D6E65772041727261792833293B77696E646F772E6F6E756E6C6F61643D66756E6374696F6E28297B74696D696E675B325D3D22723A222B286E6577204461746528292E67657454696D6528292D74293B646F63756D656E742E637265617465456C656D656E742822696D6722292E7372633D222F5F496E63617073756C615F5265736F757263653F4553324C555243543D363726743D373826643D222B656E636F6465555249436F6D706F6E656E74287374617475732B222028222B74696D696E672E6A6F696E28292B222922297D3B69662877696E646F772E584D4C4874747052657175657374297B7868723D6E657720584D4C48747470526571756573747D656C73657B7868723D6E657720416374697665584F626A65637428224D6963726F736F66742E584D4C4854545022297D7868722E6F6E726561647973746174656368616E67653D66756E6374696F6E28297B737769746368287868722E72656164795374617465297B6361736520303A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2072657175657374206E6F7420696E697469616C697A656420223B627265616B3B6361736520313A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2073657276657220636F6E6E656374696F6E2065737461626C6973686564223B627265616B3B6361736520323A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2072657175657374207265636569766564223B627265616B3B6361736520333A7374617475733D6E6577204461746528292E67657454696D6528292D742B223A2070726F63657373696E672072657175657374223B627265616B3B6361736520343A7374617475733D22636F6D706C657465223B74696D696E675B315D3D22633A222B286E6577204461746528292E67657454696D6528292D74293B6966287868722E7374617475733D3D323030297B706172656E742E6C6F636174696F6E2E72656C6F616428297D627265616B7D7D3B74696D696E675B305D3D22733A222B286E6577204461746528292E67657454696D6528292D74293B7868722E6F70656E2822474554222C222F5F496E63617073756C615F5265736F757263653F535748414E45444C3D383333323132323232383032363339393931332C393133363134393732363730323533313238302C31353336323036313036333232333737363231382C3331343939222C66616C7365293B7868722E73656E64286E756C6C297D63617463682863297B7374617475732B3D6E6577204461746528292E67657454696D6528292D742B2220696E6361705F6578633A20222B633B646F63756D656E742E637265617465456C656D656E742822696D6722292E7372633D222F5F496E63617073756C615F5265736F757263653F4553324C555243543D363726743D373826643D222B656E636F6465555249436F6D706F6E656E74287374617475732B222028222B74696D696E672E6A6F696E28292B222922297D3B";for (var i=0;i<b.length;i+=2){z=z+parseInt(b.substring(i, i+2), 16)+",";}z = z.substring(0,z.length-1); eval(eval('String.fromCharCode('+z+')'));})();iFrame detected:
Quote
<iframe style="display:none;visibility:hidden;" src="//content.incapsula.com/jsTest.html" id="gaIframe"></iframe>

polonus
« Last Edit: July 12, 2016, 06:35:32 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1131
Re: How to remove my website from your blacklist?
« Reply #200 on: July 13, 2016, 11:07:50 AM »
I did not find anything malicious on the site, so I unblocked it. However, pay attention to insecurities/vulnerabilities other users pointed out, as it might mean an infection (and adding to the blacklist again) in the future.

Offline chowkaideng

  • Newbie
  • *
  • Posts: 2
Re: How to remove my website from your blacklist?
« Reply #201 on: July 13, 2016, 04:05:39 PM »
Thanks!
Yes, we are throwing away that old site and setting up a new one, even on a different server :)

I did not find anything malicious on the site, so I unblocked it. However, pay attention to insecurities/vulnerabilities other users pointed out, as it might mean an infection (and adding to the blacklist again) in the future.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31345
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: How to remove my website from your blacklist?
« Reply #202 on: July 14, 2016, 10:48:42 AM »
That is a good start, but keep in mind that a good start doesn't always mean the end is good as well.
Keep software updated and keep checking the pages on a a regular base ;)

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 36755
Re: How to remove my website from your blacklist?
« Reply #203 on: July 14, 2016, 11:08:57 AM »
Quote
Keep software updated and keep checking the pages on a a regular base
Or buy website monitoring / security from Sucuri > https://sucuri.net/


Offline Michael925

  • Newbie
  • *
  • Posts: 2
Re: How to remove my website from your blacklist?
« Reply #204 on: July 16, 2016, 12:35:28 AM »
Hello,

Our website is reported as being in the avast blacklist. Here is the domain name: multiencargos.com

We are sure that our website is clean, therefore we would like you to take a look at it and remove it from your blacklist.

Thanks.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 36755
Re: How to remove my website from your blacklist?
« Reply #205 on: July 16, 2016, 12:45:12 AM »
Hello,

Our website is reported as being in the avast blacklist. Here is the domain name: multiencargos.com

We are sure that our website is clean, therefore we would like you to take a look at it and remove it from your blacklist.

Thanks.
Blacklisted and Dr.Web say: known infection source
https://www.virustotal.com/en/url/68c1c765c47f3149d9f14977c2405b56e8ef5a3035ada832e59e4cc41f741674/analysis/1468622414/

IP history > multiple domains on same IP and many are blacklisted
https://www.virustotal.com/en/ip-address/66.96.149.32/information/



Offline Michael925

  • Newbie
  • *
  • Posts: 2
Re: How to remove my website from your blacklist?
« Reply #206 on: July 16, 2016, 01:27:39 AM »
Hello,

Our website is reported as being in the avast blacklist. Here is the domain name: multiencargos.com

We are sure that our website is clean, therefore we would like you to take a look at it and remove it from your blacklist.

Thanks.
Blacklisted and Dr.Web say: known infection source
https://www.virustotal.com/en/url/68c1c765c47f3149d9f14977c2405b56e8ef5a3035ada832e59e4cc41f741674/analysis/1468622414/

IP history > multiple domains on same IP and many are blacklisted
https://www.virustotal.com/en/ip-address/66.96.149.32/information/

We have fully checked all website files by Dr. Web scanner (online and offline) - all clean, so there is wrong info


Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1131
Re: How to remove my website from your blacklist?
« Reply #208 on: July 16, 2016, 08:54:00 AM »
Hi, the detection was turned off 2 days ago. Please do pay attention to what others are saying and secure your domain.

Offline marc157

  • Newbie
  • *
  • Posts: 1
Re: How to remove my website from your blacklist?
« Reply #209 on: August 18, 2016, 12:14:31 AM »
Hello,

My client's URL also appears to be blacklisted by Avast. The Web Shield is reporting URL:Mal on http://www.wireside.com. I've scanned all of the files on the site by downloading them and scanning with Avast, as well as using multiple online malware scanners. I know that the site was previously infected, but is not any longer.

I scanned the site with VirusTotal and it reported that Quttera was reporting it as a malicious site (https://www.virustotal.com/en/url/ae6b38940c9dd514eb08a34dfce2cc73c1675b3d9d6a93e267a03aa5edf6e5eb/analysis/1471458795/), however when I scanned with Quttera, it was reported as not malicious: https://quttera.com/detailed_report/wireside.com.

Can you please check to see if wireside.com can be removed from the Avast blacklist if it is on one, or advise on what the problem is.

Thank you!