Our Webstore has "URL:Mal" problem by avast

[4coolday]

Hello everybody,

Our store www.4coolday.com , has "URL:Mal" warning ,
we checked by other antivirus softwares,
only has problem in Avast,
anyone can help to remove the  "URL:Mal" warning?

Thanks!

[Pondus]

Urlvoid  http://www.urlvoid.com/scan/4coolday.com/

IP address is on 5 blacklists     check IP here   
http://whatismyipaddress.com/blacklist-check

UrlQuery report    http://urlquery.net/report.php?id=1400594891703
Listed at malwaredomain.com

[4coolday]

Urlvoid  http://www.urlvoid.com/scan/4coolday.com/

thanks, we checked it before.

all is ok from the result, but in the first one: MyWOT ,
two customers wrote a bad reviews for us.

Is the main reason to let Avast show URL: mal ?

[Pondus]

See added info above

If you think this is wrong. Report it here   http://www.avast.com/contact-form.php

[4coolday]

Urlvoid  http://www.urlvoid.com/scan/4coolday.com/

IP address is on 5 blacklists     check IP here   
http://whatismyipaddress.com/blacklist-check

UrlQuery report    http://urlquery.net/report.php?id=1400594891703
Listed at malwaredomain.com

For the 5 blacklists, i don't know if it is the main reason,
i think many sites are listed in some blacklist.

We have 10 more stores, more than 5 have blacklists ,
such as another store http://www.BestR4i3DS.com (IP: 46.29.249.186 ),
please check it, it aslo has 5  blacklist.
but bestr4i3ds.com without problems in Avast.

[Eddy]

http://mxtoolbox.com/domain/www.4coolday.com/?source=findmonitors

IP resolves to friendsdatebook.com not to 4coolday.com
http://tools.pingdom.com/ping/?target=23.228.235.218&o=1&save=true

[4coolday]

http://mxtoolbox.com/domain/www.4coolday.com/?source=findmonitors

IP resolves to friendsdatebook.com not to 4coolday.com
http://tools.pingdom.com/ping/?target=23.228.235.218&o=1&save=true

I think both of them are not the main problems:
the first one, please compare our another store: http://mxtoolbox.com/domain/www.mtcard3ds.com/?source=findmonitors ,
the result is almost the same as 4coolday.com
but www.mtcard3ds.com without any problem in avast.

second one: friendsdatebook.com is the host name, i just tracerted another store: www.flashcarts.ru (158.255.2.167),
at last IP resolves to resolves to 158-255-2-167.linkhost.us not flashcarts.ru too,
flashcarts.ru is no problem in avast too,
    ,please help!
 

[polonus]

The problem was an external link to: GET /1905253.js HTTP/1.1
Host: js dot users dot 51dot la  going to 117.21.191.223
Check whether that external link is still there!
Seems that malcode has been closed, according to http://support.clean-mx.de/clean-mx/viruses.php?review=117.21.227.34&sort=first%20desc
But links to 117.21.191.223 could mean trouble for the future because of insecurities and badness history on IP and for that specific domain.
This from there still alive and kicking malcode: https://www.virustotal.com/nl/file/e354be86cf91d2a81f817a56ecffd199f84f5a789afe1c1a0f8b86df28dacc38/analysis/
or this one: https://www.virustotal.com/nl/file/e9985f40da420533f1cf0bf5ceeb6a086a693b0cfbfa57a1eb706e5c6acdff39/analysis/

Badness history of IP: https://www.virustotal.com/nl/ip-address/117.21.191.223/information/
Badness history of external link domain: https://www.virustotal.com/nl/domain/js.users.51.la/information/

polonus

[Eddy]

friendsdatebook.com sure is a problem.
It is not a host at all.
It is (was?) a dating site which is now (when I checked) not available.
Since the ip from 4coolplay resolves to friendsdatebook it sure is a problem.
It could be your host is messing up things.

[polonus]

Hi Eddy,

I get a time-out error for this site you give scanned:  https://www.virustotal.com/nl/url/5a9464ab845774417af7bf363eec6cd871c27f8179a4ceb3d65f0bf7bc20ad40/analysis/
Address is unreachable.  As I get: It's not just you! htxp://friendsdatebook.com looks down from here.

pol

[jefferson sant]

detection seems to be correct
a blocked redirection
HTML: RedirMe-inf [trj]

https://www.virustotal.com/en/file/44c82172a53b33ed2f073c56a17c4509a9ee38e44ffeb315b88d6eb88f37c29a/analysis/1400795595/


and also hxxp :/ / js.users.51.la/1905253.js infected by JS: ScriptIP-inf [trj]

http://www.google.com/safebrowsing/diagnostic?site=js.users.51.la

https://www.virustotal.com/en/file/6adc15e0f46335bef9166957729ad0893f712e039089ec80df17b459be61e62f/analysis/1400795777/

This domain is listed in the hpHosts blacklist

http://vurldissect.co.uk/default.asp?url=http%3A%2F%2Fjs.users.51.la%2F1905253.js+&btnvURL=Dissect&selUAStr=1&selServer=1&ref=hxxp%3A%2F%2Fjs.users.51.la%2F1905253.js+&cbxLinks=on&cbxSource=on&cbxBlacklist=on