Avast marks my webpage as a dangerous site. FALSE POSITIVE

system · 2015-11-06T18:45:59.000Z

Hi, I’m having some trouble with my webpage.
Many people have been unable to access the site due to Avast warning about it being unsafe (https://imageshack.us/i/p7uZx5Ggp). As far as I know, the problem seems to be the Avast extension for Chrome and Firefox. In my computer I’ve disabled the extensions and had no more problems, but that’s not a solution I can give to the people visiting my site.
I’ve already run scans at virustotal.com and sitecheck.sucuri.net/results/taller-9.com.ar. They don’t report any problems concerning being blacklisted nor infected, but at sucuri I got a warning because the site couldn’t be scanned properly, and telling me I should talk to my hosting provider. I already did, and they told me everything was OK.

Any ideas?
Thanks in advance!

Pondus · 2015-11-06T18:54:32.000Z

It could be a IP block. Multiple domains on same IP and many are blacklisted

IP history https://www.virustotal.com/en/ip-address/31.170.164.105/information/
Click more button under list (s) fore more info

Eddy · 2015-11-06T19:36:52.000Z

Definitely a IP block.
http://zulu.zscaler.com/submission/show/ebe12bc418bb6d738499f43ac5a5e2e8-1446838372
http://urlquery.net/report.php?id=1446840479939
http://urlquery.net/report.php?id=1446840443412

508 loop
https://sitecheck.sucuri.net/results/taller-9.com.ar

Blacklisted domain & IP
http://multirbl.valli.org/lookup/taller-9.com.ar.html
http://multirbl.valli.org/lookup/31.170.164.105.html

No secure protocols supported
https://www.ssllabs.com/ssltest/analyze.html?d=taller-9.com.ar

No SPF record (allows spam)
http://www.dnsinspect.com/taller-9.com.ar/1446840818

polonus · 2015-11-06T21:53:15.000Z

Just some additions to Eddy’s report. Detected libraries:
jquery-migrate - 1.2.1 : -http://taller-9.com.ar/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
jquery - 1.11.3 : (active1) -http://taller-9.com.ar/wp-includes/js/jquery/jquery.js?ver=1.11.3
(active) - the library was also found to be active by running code
1 vulnerable library detected

Adblockers also block IP as uMatrix has prevented the following page from loading:
-http://error.hostinger.eu/? free Amzon hosting…

polonus

HonzaZ · 2015-11-09T08:32:01.000Z

The URL is blocked too, though. We spotted a malicious file here in March 2014:
taller-9.com.ar/1938011505/1/1396147920.pdf
Most likely NuclearPack exploit kit.

Let me know when you clean your domain, update all systems, change all passwords, then we will unblock it ;)!

Eddy · 2015-11-09T10:23:52.000Z

It has gotten even worse.
As of today a lot of links to this :
http://zulu.zscaler.com/submission/show/07a374c5a4d7d2d5387c776206994609-1447064554

Asyn · 2015-11-09T10:45:53.000Z

→ https://sitecheck.sucuri.net/results/krol.com.ar/

system · 2015-11-09T20:58:09.000Z

Hey guys, thanks A LOT for your help!

Announcements