Author Topic: Fix URL:MAL on a safe domain  (Read 1347 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Fix URL:MAL on a safe domain
« on: April 28, 2018, 06:09:48 PM »
I'm receiving an Infection type: URL:Mal warning for ksef.kstc.com. I followed some of the procedures and advice from other posts and tested the site.

Zulu found it clean except for one component that was suspicious, but when reanalyzing that specific component found it to be clean.
https://zulu.zscaler.com/submission/04d5402d-b5c4-43fc-998f-9fb9ce877ebf

Sitecheck called it clean with no listing on blacksites.
https://sitecheck.sucuri.net/results/ksef.kstc.com

URLcheck didn’t work for me – stayed “queued” overnight.

I logged all the results from Zulu and Sitecheck in case any of it is important.

I checked with one of the folks at KSEF and got this response:
“Yes, this has happened to others. We've had Russian/eastern europe trolls for years, but they just put a warning or redirect to a different site, they don't get past our firewalls... The sites are up....”

The website hosts a submission service for grant applications. They are due soon and I need to be able to access the site. Obviously I could bother some colleagues to use their non-Avast computers, but can this be fixed so I (and I understand others as well) can access the site?

Thanks!

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Fix URL:MAL on a safe domain
« Reply #1 on: April 28, 2018, 06:14:17 PM »
You can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1038
Re: Fix URL:MAL on a safe domain
« Reply #2 on: May 02, 2018, 07:07:55 AM »
I removed ksef.kstc.com from our blacklist.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33904
  • malware fighter
Re: Fix URL:MAL on a safe domain
« Reply #3 on: May 02, 2018, 05:40:04 PM »
Given as a secure site here: https://www.scamadviser.com/check-website/ksef.kstc.com
and here as well: https://retire.insecurity.today/#!/scan/ebd81df0d3e76604132a08273954b5f00069c014e475f3756e5c1142157e722a

The nature of the PHP template software ( http://ksef.kstc.com/index.php/p+ ) used makes the website stands open for info proliferation:
https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=ksef.kstc.com&ref_sel=GSP2&ua_sel=ff&fs=1

See sources and sinks -> http://www.domxssscanner.com/scan?url=http%3A%2F%2Fksef.kstc.com%2Findex.php
See the Kevin van Zonneveld code here: Results from scanning URL: hxtp://ksef.kstc.com/components/com_rsform/assets/js/script.js
Number of sources found: 35
Number of sinks found: 11
&
Results from scanning URL: htxp://ksef.kstc.com/modules/mod_rokajaxsearch/js/rokajaxsearch.js
Number of sources found: 13
Number of sinks found: 12

error in above javascript code
Quote
ksef.kstc. dot com/modules/rokajaxsearch/js/rokajaxsearch.js
     status: saved 24184 bytes 82f85636797e45f3e777cfdafb5d5ef145146fc8
     info: [decodingLevel=0] found JavaScript
     error: undefined variable Class
     error: undefined variable Options
     error: undefined variable Events
     error: line:121: TypeError: Class is not a constructor
Consider this link on that error: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/Not_a_constructor

polonus (volunteer website security analyst and website error-hunter)
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!