Blacklist server

system · 2017-07-06T10:18:12.000Z

Hello !

I have one problem, some months ago my website has been hacked www.camping-les-mimosas.com

Everything is fine now, no virus, no spams (cf blacklist)

But the problem Avast still blacklisted my website and so the IP of my server (5.39.80.54) it means all websites who’re on my server are blocked by Avast also but the others antivirus didn’t block them.

Can you put back my ip in the whitelist ?

Thanks a lot !

Julien

Asyn · 2017-07-06T10:22:47.000Z

You can report a URL here: https://www.avast.com/report-a-url.php

Eddy · 2017-07-06T10:25:17.000Z

Blacklisted IP :
https://www.virustotal.com/en/ip-address/5.39.80.54/information/

Vulnerable library used :
http://retire.insecurity.today/#!/scan/191b371b581ff38903de0fac2f0ef25098b0ae7e69db158ce1785e6898f4a587

Blacklistings on that ASN :
http://urlquery.net/report.php?id=1499334457583

system · 2017-07-06T10:46:29.000Z

thanks but these alerts are no longer available because all viruses and suspected files were deleted and problems fixed

Julien

Eddy · 2017-07-06T10:49:04.000Z

No, not all problems are fixed.
You still need to retire the vulnerable library.

system · 2017-07-06T11:00:35.000Z

ok I did deleted the previous version of jquery, upload and update the new one and now it said no vulnerability

Eddy · 2017-07-06T11:03:25.000Z

Well done.
I wish more website owners would take action that quick.

Now it is up to avast to check and if nothing found remove it from their blacklist.

system · 2017-07-06T11:07:10.000Z

thanks ! so I just need to wait right ?

Eddy · 2017-07-06T11:10:56.000Z

Yup, that is all you have to do.

polonus · 2017-07-06T15:12:57.000Z

Hi Julien72,

Eddy has sketched some issues that you now seem to have mitigated, there are still some issues to look into or report to the hosting of that website.

Some advice to enhance website security for this site: https://observatory.mozilla.org/analyze.html?host=www.camping-les-mimosas.com F-status and recommendations. (site can be accidentaly been visited over http:// ).

Consider: http://www.domxssscanner.com/scan?url=https%3A%2F%2Fwww.camping-les-mimosas.com
For wowslider:

Results from scanning URL: -https://www.camping-les-mimosas.com/js/menu/menu.js
Number of sources found: 37
Number of sinks found: 11

Detected errors

error: line:15: SyntaxError: missing ) after condition:
error: line:15: t+n.left}if(z.top<n.top){y-=z.top+n.top}var v=(n.left+n.width)-z.left-q/c;if(0>v){A+=v}var t=(n.top+n.height)-z.top-o/k;if(0>t){y+=t}}else{var A=qw/c;var y=ou/k}d(this).find(“img”).css({left:-(qw/c)+“px”,top:-(ou/k)+“px”,width:q+“px”,height:o+“px”}
error: line:15: …^

anti-evasion obfuscated adware script with fingerprinting risks. This should be taken up with those responsible for the code of javascript obfuscator at http://javascript-source.com/ (remarks by me, polonus)

Cert. with errors: wXw.camping-les-mimosas.com
You have 1 error
Wrong certificate installed.
The domain name does not match the certificate common name or SAN.
Warnings
Root installed on the server.
For best practices, remove the self-signed root from the server.
Plesk ns321609.ip-37-187-3.eu → http://toolbar.netcraft.com/site_report?url=ns321609.ip-37-187-3.eu

DNS report issues: FAIL: While quering domain’s records, some of your name servers didn’t responded. Name servers which didn’t responded:
udp4:213.186.33.199
udp6:2001:41d0:8:2b87::

WARNING: We found different serial numbers on your name servers, it’s OK if you had modified your zone recently.
2001:41d0:8:2b87::: 0
213.186.33.199: 0
37.187.3.197: 2017070603
Having different serials on your name servers may show inconsistencies between name servers configuration (multiple masters), or communication errors (ACL and firewall issues).

Some of these issues are hosting related and should be taken up with tech@ovh.net

polonus (volunteer website security analyst and website error-hunter)

system · 2017-07-06T15:48:36.000Z

hello polonus and thanks for your answer !

I’ll fix the others problems, about the certicate actually that’s normal because I changed the server for this website and the IP and the SSL certificate will be fine in 24 / 48 hours

Julien

LukasJ · 2017-07-06T17:14:38.000Z

Hi, URL has been removed from blacklist.

Regards
Lukáš

system · 2017-07-06T17:15:26.000Z

Thanks a lot !

Announcements