Author Topic: How to remove my website from your blacklist? (Read 203830 times)

jefferson sant · « **Reply #600 on:** August 26, 2019, 03:49:11 PM »

Quote from: trspencer on August 24, 2019, 04:36:09 AM

Hello -

hxxps://www.mylakeshoredental.com was recently transferred to our environment from an infected host. New content, new hardware, nothing was transferred from the previous environment.

Can you please recheck site and remove from blacklist?

https://sitecheck.sucuri.net/results/https/www.mylakeshoredental.com

Thank you!
Tim

Detection was removed in 26.08.2019 08:43 AM.

Quote from: Avast

Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

polonus · « **Reply #601 on:** August 26, 2019, 08:48:24 PM »

Thanks to jefferson sant for the apt status response.
we all here owe you for doing this, great job.

polonus

jefferson sant · « **Reply #602 on:** August 27, 2019, 04:29:25 AM »

Quote from: polonus on August 26, 2019, 08:48:24 PM

Thanks to jefferson sant for the apt status response.
we all here owe you for doing this, great job.

polonus

You're welcome.I have bad news less time now for this in the next days : (
There is no doubt that they have been working the at best even if some are on vacation

https://www.avast.com/false-positive-file-form.php

SCompartir · « **Reply #603 on:** September 10, 2019, 06:18:37 PM »

Hello,

We need your help to review one of our sites.
Some users are receiving Avast phishing alerts on the following page: http://lms30.santillanacompartir.com/

I checked the link and it looks clean:
https://www.virustotal.com/gui/url/4ed49a96f5b774bb096c7adfb0f2fe88c3abb0660c18cc77ee5ed58f264bb69e/detection
https://www.urlvoid.com/scan/lms30.santillanacompartir.com/

Can you please remove it from the list?
thanks in advance

Pondus · « **Reply #604 on:** September 10, 2019, 10:16:26 PM »

Report a false positive (select file or website)
https://www.avast.com/false-positive-file-form.php

SCompartir · « **Reply #605 on:** September 12, 2019, 05:58:27 PM »

Quote from: Pondus on September 10, 2019, 10:16:26 PM

Report a false positive (select file or website)
https://www.avast.com/false-positive-file-form.php

Thanks Podus.

We reported it yesterday but we still have no solution. It is an important issue that is causing problems in the schools that use our software.
Any help is very much appreciated

bob3160 · « **Reply #606 on:** September 12, 2019, 10:36:14 PM »

Reported to Avast. Hope that helps.

Milos · « **Reply #607 on:** September 13, 2019, 07:46:33 AM »

Hello,
it should be fixed.

Milos

heidiw · « **Reply #608 on:** September 27, 2019, 07:49:21 PM »

Hello, our site has been blacklisted but gets a clean report from every testing site, including virustotal.com and urlvoid.com. I've probably tested and retested on at least a dozen different sites with the same results.

I've submitted to Avast's "Report a False Positive" form linked above, but thought I'd check in here for additional guidance. Our site is hbsslaw.com.

Thank you in advance for any help,
Heidi

polonus · « **Reply #609 on:** September 28, 2019, 11:36:53 AM »

Hi heidiw,

Has that shellscript malware now left you?
Seems OK here: https://www.virustotal.com/gui/domain/hbsslaw.com/details

See various detections in communicating files and files referring:
https://www.virustotal.com/gui/ip-address/104.248.8.42/relations (shellscript malware)
-> https://www.virustotal.com/gui/file/e1c40eab45d98265548859ffb3df941bb7329e01f5ddb08e3b98c3c1c3a83175/detection

Recommendations acquired via linting to improve your website:
https://webhint.io/scanner/ad92d914-488d-4594-bda6-0fe00ee5954a

See existing vulnerabilities on the hoster of the webserver for IP: https://www.shodan.io/host/104.248.8.42
N.B. The device at Clifton may not be impacted by all of these issues.
The vulnerabilities are implied based on the software and version.

Wait for the final verdict of an avast team member, as we here are volunteers with releative knwoledge,
but only avast team members can come and unblock (whenever that is advisable)

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

vickykuo · « **Reply #610 on:** September 30, 2019, 04:02:31 AM »

Hello

My company website "mydesigncell.com" is blocked by avast

But my website is safe now

Please remove my website from your blacklist

Thanks~~!!!

Michael (alan1998) · « **Reply #611 on:** September 30, 2019, 05:33:17 AM »

You're blacklisted by ZeroCERT >> https://www.urlvoid.com/scan/mydesigncell.com/
VirusTotal reports Suspicious >> https://www.virustotal.com/gui/url/9c3cef781db545947cdb87ee959c9d2504fe1394d9bdc2e47df29ffb0c0b9c29/detection

Sucuri reports outdated nginx >> https://sitecheck.sucuri.net/results/www.mydesigncell.com

One of your subdomains (share(dot)mydesigncell(dot)com) is tagged for malware.

Primary >> https://zulu.zscaler.com/report/f8cfb7aa-0a5f-45f4-bf3e-c419bdc51ac2
Share (SD) >> https://zulu.zscaler.com/submission/a74d1606-7a6d-4ac2-9088-85f1bbaad50c

Can't for the life of me get URLQuery.net working (@polonus)??

You had a spam problem at one point I take it? (>1 year old) >> https://exchange.xforce.ibmcloud.com/url/mydesigncell.com
JS:Downloader >> https://exchange.xforce.ibmcloud.com/malware/20FC20EE7D21686397F7CFFF968CDFA6

AW-SNAP!

Wait for official reply from Avast!

polonus · « **Reply #612 on:** September 30, 2019, 01:17:57 PM »

@ Michael (alan1998) & vickykuo,

Michael (allan 1998) quite impressive in the scan results.
Walk in my shoes, a very present surprise for me.
Domain is at constant risk of being hijacked, that is the main threat there.

Also interesting are the detections, that one will get via Virustotal's relations on that IP,
see: https://www.virustotal.com/gui/ip-address/67.20.76.105/relations
and that "suspicious"domain is parading there as nuber 3 and 4 in the list:
https://www.virustotal.com/gui/url/73d01d1a40280ff5b32a5c6ec24b6e7c091c61d60035d1e8d8f85c40d9172cb4/detection
and https://www.virustotal.com/gui/url/e7ece1957115a109f44c349f9884b03a398058b070a6c7da4bd6e5582b2f8529/detection

The threats against this website, 12 immediate threats mentioned here: https://webscan.upguard.com/#/www.mydesigncell.com

One should be interested in URLQuery.net results because of it having Forcepoint Threatseeker aboard,
Emerging Threats and other IDS. URLQuery. net is not very popular by cybercriminals that wanna stay under the radar,
so it has come under continuous attack. Remember Clean-MX once, that is now only open for members with a personal account.

Here you got what you were after. However I won't reveal how I got there, as the baddies are looking over my shoulder as well:
https://urlquery.net/report/270ef31c-6fc1-410d-9120-9bcc462c88c5

As Michael (alan1198) said wait for a reaction from an avast team member,
as they are the only ones to come and unblock),
we are just the folks with relative knowledge on website security and error-hunting.

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

Michael (alan1998) · « **Reply #613 on:** September 30, 2019, 01:26:40 PM »

Quote from: polonus on September 30, 2019, 01:17:57 PM

@ Michael (alan1998) & vickykuo,

Michael (allan 1998) quite imperessive in the scan results.
Walk in my shoes, a very present surprise for me.
Domain is at constant risk of being hijacked, that is the main threat there.

I'm still no where near you're level

. I'll see about reaching out to URLQuery and getting an account. Can't find an email, but DM'd them on Twitter. Their account doesn't appear active though :/

polonus · « **Reply #614 on:** September 30, 2019, 02:00:19 PM »

Hi Michael (alan 1998),

Don't be too modest now, you are one of my best adepts

Oh well, and you should know now how to get to these urlquery dot net results by now

Damian