Blocking false malware

General Topics
1

Hello there guys

Why is avast blocking my ip : 94.249.189.185 and my website : ngcmta.com and it hadn’t got any virus or any malware :\

I need to unblock it cause it makes many problems to my business

2

You can report a possible FP here: http://www.avast.com/contact-form.php

3

Aysn I reported it before but no thing happened

4

How did you report it…?

5

http://www.websicherheit.at/en/security-tools/web-security-test-scan-results/
Suspicious
http://www.game-state.com/iframe.php?ip=94.249.189.185&port=22003&bgcolor=000000&bordercolor=474747&’
Google / Browser Difference
Not identical
Google: 47215 bytes Firefox: 51074 bytes
Diff: 3859 bytes
First difference:
/index.php?phpsessid=0pknufo2iafiq6q26dhfb1nqm2&"; var smf_iso_case_folding = true; var smf_charset = “iso-8859-1”; var ajax_notification_text = “loading…”; var …

http://zulu.zscaler.com/submission/show/79f2f6e9a6b0280c84b20a5036ba1ca1-1414584715
http://urlquery.net/report.php?id=1414585083618
http://dnscheck.pingdom.com/?domain=ngcmta.com
http://www.ipvoid.com/scan/94.249.189.185/
https://www.ssllabs.com/ssltest/analyze.html?d=ngcmta.com

6

I reported it as false malware

7

I checked the most sites you posted and no virus / malware detected

8

Sure, but how…? Did you use the form…?

9

There are more reasons to block a IP/Domain besides malware.

ps:
Each virus is malware, but not the other way around.

10

@Eddy I hadn’t got any virus and this is avast results it’s a false block

@Asyn which form ? just told them to unblock it cause it’s false malware / virus

11

avast doesn’t say that there is malware.
URL:Mal means it is blocked, most likely a IP block.

Asyn means:
www.avast.com/contact-form.php

12

@Eddy ok what to do now ?

13
@Asyn which form ? just told them to unblock it cause it's false malware / virus
How did you report it ...means = did you phone avast?, did you send a mail to avast?, did you use the online form on there website? http://www.avast.com/contact-form.php
14

IP address history https://www.virustotal.com/nb/ip-address/94.249.189.185/information/

https://www.virustotal.com/nb/url/6d07fdfaf5d7a8e8ea983781ffdfb81e57502696dc47bfe7670ba3af22d02c25/analysis/
https://www.virustotal.com/nb/url/aad1be5abdb68221288fc61b9c91b72cfd162a83ddf06d14e2f9642f1cd34948/analysis/

15

Ik pondus now it 100% clear so ?

16

Errors here: http://dnscheck.pingdom.com/?domain=+ngcmta.com → http://dnscheck.pingdom.com/?domain=+ngcmta.com&timestamp=1414594823&view=1
Warnings: https://asafaweb.com/Scan?Url=ngcmta.com
Probably IP block because of other domains on IP infested: https://www.virustotal.com/nl/ip-address/94.249.189.185/information/
Request a IP block domain exclusion.

polonus

P.S.
Site stays vulnerable because of: htxp://ngcmta.com/index.php?PHPSESSID=0vb24747oa7srt76adg8o98c04&action=login
XSS vulnerabilities:
->: hxtp://ngcmta.com/index.php?PHPSESSID=0vb24747oa7srt76adg8o98c04&action=login
Number of sources found: 3
Number of sinks found: 72
and
->: htxp://ngcmta.com/Themes/default/scripts/sha1.js
Number of sources found: 94
Number of sinks found: 4
and
→ URL: htxp://ngcmta.com/Themes/default/scripts/sha1.js
Number of sources found: 16
Number of sinks found: 37

iFrame xss vuln for: Results from scanning URL: htxp://www.game-state.com
Number of sources found: 3
Number of sinks found: 609 vuln. to hades-exploit

D

17

So what to do?

18

https://forum.avast.com/index.php?topic=158460.msg1142848#msg1142848

19

You have told several times already what to do.
One of the times is in reply #15

20

Ok reported it as a false malware