Author Topic: Website reported as blocked for URL:Mal, report false infection?  (Read 24367 times)

0 Members and 1 Guest are viewing this topic.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 36691
« Last Edit: June 22, 2017, 05:12:21 PM by Pondus »

Offline mchain

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 5415
  • Spartan Warrior
Windows 10 Home 64-bit 1909 Avast Premier Security version 20.1.2397 (build 20.1.5069.559) UI version 1.0.460.

Offline adan6

  • Newbie
  • *
  • Posts: 2
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #32 on: June 22, 2017, 08:55:27 PM »
Strange that it is not loading because we have customers on it all day and it is working for me off site. 
I have contacted yandex and they have cleared my site but I guess it's not updated. 
I contacted the other too but have not heard back from them expect for sucuri, they want money to remove me.  That doesn't seem right.  Is there anything else I can do?

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31345
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #33 on: June 22, 2017, 09:11:53 PM »
You could start with fixing the Wordpress issues and the certificate issue.

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1130
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #34 on: June 23, 2017, 12:18:52 PM »
allegiantcare[.]com is unblocked since yesterday, 17:42 CEST, but I strongly suggest following advice of other people commenting on this issue.

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 32540
  • malware fighter
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #35 on: June 23, 2017, 01:26:25 PM »
No direct threat coming from website, so it was unblocked by Avast Team: http://urlquery.net/report.php?id=1498213066446

However for the Word Press settings User Enumeration and Directory Listing should be set disabled.

The server at Verizon's is set to speak too loudly Server: Apache/2.4.23 (Win64) OpenSSL/1.0.2j PHP/7.1.2
X-Powered-By: PHP/7.1.2 (excessive server info proliferation, we call this issue). PHP also can be' a can of worms' (vuln.).

For this external link we see a secure cookies warning, clickjacking warning and a http to https warning: https://asafaweb.com/Scan?Url=go.microsoft.com%2Ffwlink%2F%3Flinkid%3D66138%26clcid%3D0x409 - was on: https://aw-snap.info/file-viewer/?protocol=secure&tgt=accreditnet2.urac.org&ref_sel=GSP2&ua_sel=ff&fs=1 (hhtp blocked for shared hosting)!

Suspicious urls with this external link: https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=www.surveymonkey.com&ref_sel=GSP2&ua_sel=ff&fs=1  with particular issues and warnings here: https://asafaweb.com/Scan?Url=https%3A%2F%2Fwww.surveymonkey.com

So you have issues for the website and you have to take up certain proliferation issues with provider Verizon's (not maintaining best policies because of incompetence, not being interested to tackle issues or other factors, which is not offering you the best of infrastructure, a shame really but what can we do when regulators turn a blind eye and commerce rules big time  ;).

polonus (volunteer website security analyst and website error-hunter)
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline bruno.felipe

  • Newbie
  • *
  • Posts: 1
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #36 on: November 08, 2017, 01:52:59 PM »
Hi, i need help please!!

My website is block with URL:Mal by avast, how i resolve it?

Thansk

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1130
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #37 on: November 08, 2017, 02:02:52 PM »
which website? Post a link here or at least a printscreen of the detection ;)

Offline tim.owens

  • Newbie
  • *
  • Posts: 2
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #38 on: November 14, 2017, 04:29:03 AM »
We are in the same boat - I have numerous clients reporting our site is unsafe, but as the IT Director, of app.espace.cool - I can guarantee we are safe and behind a secure firewall at LiquidWeb.  It's really starting to impact our business.  We serve many large churches in the US and they are soon going to be moving to other anti-virus software if we can't get someone from Avast to answer our false detection report.  I've seen in 3 separate emails and even called.  Was told someone would call me right back.. that was 3 days ago.. still waiting.  PLEASE HELP!

Offline Asyn

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 65453
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #39 on: November 14, 2017, 05:05:46 AM »
We are in the same boat - I have numerous clients reporting our site is unsafe, but as the IT Director, of app.espace.cool - I can guarantee we are safe and behind a secure firewall at LiquidWeb.  It's really starting to impact our business.  We serve many large churches in the US and they are soon going to be moving to other anti-virus software if we can't get someone from Avast to answer our false detection report.  I've seen in 3 separate emails and even called.  Was told someone would call me right back.. that was 3 days ago.. still waiting.  PLEASE HELP!
You can report a URL here: https://www.avast.com/report-a-url.php
Win 8.1 [x64] - Avast PremSec 20.6.2416.B#1 [UI.537] - CC 5.68 - EEK - FF ESR 68.10 [NS/AOS/uBO/PB] - TB 68.10 - SB/CP/SL/DU.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1130
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #40 on: November 14, 2017, 07:47:07 AM »
I have removed app.espace[.]cool/account/login from our blacklist ;)

Offline tim.owens

  • Newbie
  • *
  • Posts: 2
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #41 on: November 14, 2017, 12:45:54 PM »
 ;D ;D ;D ;D - Thank you!

Offline zapappa

  • Newbie
  • *
  • Posts: 5
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #42 on: January 24, 2018, 04:34:30 AM »
If Avast is reporting MAL:URL on the basis of the domain name being on a blacklist would you PLEASE, PLEASE display the name of the blacklist on which it was found?

When the Avast popup says "...because it was infected with URL:Mal", if it is really just reporting that the target website is being blocked because it is listed on a blacklist, then why not display "...because it is listed on the Barracuda blacklist" (or whatever blacklist)? 

Or display "...because it is listed on the one or more blacklists" and list the blacklists in the "details" section.

If I have not understood URL:Mal then I apologize but it seems to get a lot of people running around wondering how to remove the "URL:Mal infection".  Again, if URL:Mal is simply indicating a blacklist entry then calling it an infection causes a waste of time and effort.
« Last Edit: January 25, 2018, 03:01:04 AM by zapappa »

Offline mchain

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 5415
  • Spartan Warrior
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #43 on: January 29, 2018, 06:36:17 PM »
Blacklisted infection entries are there for your protection.  Sometimes, but not often, these blocks are false positives, but these can occur when a known blacklisted site shares an IP address with many websites and is itself not infected with malware.

Some real-time security websites are listed below to verify an URL:Mal block:
https://www.virustotal.com/#/home/url
https://sitecheck.sucuri.net/
http://urlquery.net/

Please treat blacklisted sites with due care and caution, always.
Windows 10 Home 64-bit 1909 Avast Premier Security version 20.1.2397 (build 20.1.5069.559) UI version 1.0.460.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 36691
Re: Website reported as blocked for URL:Mal, report false infection?
« Reply #44 on: January 29, 2018, 08:33:27 PM »
Quote
If Avast is reporting MAL:URL on the basis of the domain name being on a blacklist would you PLEASE, PLEASE display the name of the blacklist on which it was found?
   
Avast is using there own Blacklist


Quote
If I have not understood URL:Mal then I apologize but it seems to get a lot of people running around wondering how to remove the "URL:Mal infection".  Again, if URL:Mal is simply indicating a blacklist entry then calling it an infection causes a waste of time and effort.   
You can only remove it if you own the website, and there are many reasons why a website is blacklisted, it does not have to be infected