False Positive: Site Blocked - URL:Phishing

[bryan221]

You have to wait for a final verdict from an avast team member, as avast has followed GData's detection here.
See VT url scan results.

Indicators for detection: https://urlscan.io/result/f52ddb27-a4a6-440b-bcda-29cdb36045ce/#indicators
-d26lpennugtm8s.cloudfront.net (pinterest dot com stores etc.), -va.tawk.to, -www.siteblindado.com etc.

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

ok, I will wait, I have already zipped the whole site and sent it to the G data to analyze it, explained the whole situation, sent all the licensed systems I use as WHM, WHMCS, Cloud Linux and they answered automatically:

"Dear customer,

*** This message is an automatic e-mail response ***

Thank you for your sample submission.
A ticket for your submission has now been created and added to the processing queue.
Our analysts will examine your submission and you will get a reply with the solution and / or verdict for the submitted files / URLs.

Please note that we are receiving a large number of submissions per day, the processing of your ticket may take time.
Thank you for your patience.

Best Regards,
SecurityResponse Team

G DATA CyberDefense AG • G DATA Campus • Königsallee 178 "

I only have 2 options or I wait for the G-DATA to release or Avast removes and helps me.

the links are only images like cloudfront, etc., that I did not host on my server, I left on the CDN, I really have to upload it on my server, but I believe that this is not the problem because we have used it for months without any problem.

[polonus]

Hi bryan221,

I hope for you soon after this long weekend, you will be in for a final reply.
Hope that all ends well for you,

polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)

[bryan221]

Hi bryan221,

I hope for you soon after this long weekend, you will be in for a final reply.
Hope that all ends well for you,

polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)

Hi polonus,

thank you very much, the support is very good, super effective, you respond very quickly and calm us down!

[DavidR]

@ bryan221
You might want to check this out - https://awesometechstack.com/analysis/website/rubfy.com.br/ - as it reports some of the software needs to be updated, jQuery and Bootstrap.

[polonus]

Good advice towards bootstrap and jQuery version updates, however....

Whenever scanning at awesometechstack dot com, better keep following inline script blocked:
-https://m.servedby-buysellads.com/monetization.js (blocked by uBlockOrigin for me) (not malicious per se, but ad-tracking)
Re: https://www.virustotal.com/gui/ip-address/108.161.189.78/relations

polonus

[larkinsen]

Hi.I'm trying to pay a bill through hxtps://secure.euplatesc.ro/ and it says that was blocked due to phishing infection.I didn't have this problem until now.Please whitelist it or review it.Thanks

[Pondus]

Hi.I'm trying to pay a bill through https://secure.euplatesc.ro/ and it says that was blocked due to phishing infection.I didn't have this problem until now.Please whitelist it or review it.Thanks

https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

[polonus]

Scamvoid says potentially safe. But we see a link redirecting to facebook & linkedin:
Outgoing Links

-https://www.facebook.com/EuPlatesc.ro CleanMX flags this a s PHISHing link.
 
-https://www.linkedin.com/groups/eCommerce-Romania-1843035/about  CleanMX flags this a the PHISHing link

So avast's detection can be based on CleanMX's detection.

polonus (volunteer 3rd party cold recon website security-analyst and website error-hunter)

[Richard80]

The avast software is saying that our company domain hxtps://productmarketingalliance.com/ is blocked because of phishing..?

It's caused some concern to our members. Can we understand what happened here and what had triggered the false positive?

Thank you in advance for clarification.

Kind regards

Rich

[Asyn]

Hi, you can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php

[Richard80]

Hi, you can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php

Thanks - I've gone ahead and done this - does anyone know how quickly these are corrected?

[Asyn]

You're welcome. You should get a reply within 48 hours.

[polonus]

It is probably the IP that is being flagged because of this:
https://www.abuseipdb.com/whois/178.128.137.126
whereas these scan results are fine: https://www.virustotal.com/gui/url/bb53362762c58f22ebb3248a4c8c3f3b255bbb521be8abdff4d2f0efcbb5c28c/details
So wait for a final verdict from avast team,

polonus

[Bogdan Schimbischi]

Hello,
Our website is flagged as Phishing and that is not true.

Thank you in advance for clarification.

Website: hxtps://www.companisto.com
https://urlscan.io/result/e7165a1f-09bc-443f-a00c-b8a4af672197/
https://www.virustotal.com/gui/url/42c93f5ba47310032cf3c0fbc5a552a1ef2448b0d188900a44b3289c66366e59/detection

Already reported here: https://www.avast.com/false-positive-file-form.php

[DavidR]

@  Bogdan Schimbischi
When did you report it  ?
You should get a response in a day or two.