Clean web site blacklisted with Avast

Viruses and worms
1

Good evening, my site was blocked by Avast, but check the site indicate that no viruses. Avast virus found the following type: URL:MAL
Site Address http : make-games.ru
Screenshot problem: http://hostingkartinok.com/show-image.php?id=06c45464f8b5ea821936823e9f7ce0d9

Scan on virustotal 0 / 51 : https://www.virustotal.com/ru/url/4b96770489b9fca9054104dd64e7b4a40449a0e4a2428852c87a4959c9f77318/analysis/1388169144/

Thanks!

2
Good evening, my site was blocked by Avast, but check the site[b] indicate that no viruses.[/b]
URL:mal is not infection but means the URL or IP is on a blacklist for whatever reason ...it does not have to be infected

and Virustotal URL scan does not check for infections but check against blacklists/reputation

3

well your IP (195.216.243.7) is listed here http://www.sorbs.net/lookup.shtml and reason seems to be spam

Summary information for 195.216.243.7/32 Note: Times shown are for the latest entry only! Found 2 network entries and 0 host/domain entries.

Problem Entries, (listings will cause email problems.)
1 “Spam” entries [05:07:53 15 Sep 2011 GMT+00].

Usage classification (only important if you run your own mailserver.)
Note: Active “exDUHL” entries mean that the IP/Network has been unblocked for some or all IPs from the DUHL.

Problem hostnames/domains (could cause email problems.)
1 “Spamvertised” entries [05:07:53 15 Sep 2011 GMT+00].
Note:These entries are for URLs or email domains, the IPs that may show up as ‘spamvertised’ only indicate where the URL/Host was seen being sent from. Listings for IPs that are ‘spamvertised’ will not usually cause blocking problems unless the email contains the IP address as a URL
Note: For a more detailed view you have to be registered and logged in.

Current Listings (active)
Historical Listings (inactive)
Current Listing with an active exception
Current Listing however, listings of these types can help mail delivery rather than cause blocking.

4

also see here http://urlquery.net/report.php?id=8573282
detectin by Suricata filter, see Intrusion Detection Systems “ET RBN Known Russian Business Network IP group 91”

Russian Business Network http://en.wikipedia.org/wiki/Russian_Business_Network

also see Recent reports on same IP/ASN/Domain where you find one URL using same IP as you and has Detected malicious iframe injection + ET RBN Known Russian Business Network IP

this one, see here http://urlquery.net/report.php?id=8242122

your site is supicious at unmaskparasites http://www.UnmaskParasites.com/security-report/?page=make-games.ru

5

For what our good webforum friend Pondus means here,
consider also the live malware originating from that IP listed here:
http://support.clean-mx.de/clean-mx/viruses.php?ip=195.216.243.7&sort=source%20desc

See the site has IDS for being part of Known Russian Business Network IP group 91 → https://urlquery.net/report.php?id=8573335

And from here on same IP malicious Kazy Trojan is being spread: https://urlquery.net/report.php?id=8267766
So that infesting domain “earned” the general IP URL:Mal detection status for the remainder of the domains there!
Also this malware fromIP detected: https://www.virustotal.com/nl/file/922e285e6b468c036fe476aa05f9e802f0ae0393df82309c64338720a1c19771/analysis/

polonus

P.S. htxp://sitecheck.sucuri.net/results/kapatelu.clan.su is blocked and flagged by avast! WebShiekld for given away too much of
JS:iFrame-ACP[Trj]

D

6

Hello, I changed the hosting with Ucoz on uWeb.
IP has changed to: 193.109.246.214
I do not understand much with this site, but I checked the IP:
http://urlquery.net/report.php?id=8693047
I understand, and this IP is blacklisted?

Sorry for not literate in English.

[suspicious]
Original
Здравствуйте, я сменил хостинг с Ucoz на uWeb.
IP сменился на: 193.109.246.214
Я не сильно разбираюсь с этим сайтом, но я проверил ИП:
http://urlquery.net/report.php?id=8693047
Я так понимаю и этот ИП в черном списке?

Извините за не грамотный английский.
[/suspicious]

7

urlquery show that the IP is related to ET RBN Known Russian Business Network IP group 170

Russian Business Network http://en.wikipedia.org/wiki/Russian_Business_Network

IP is not on any blacklist here http://whatismyipaddress.com/blacklist-check :wink:

8

Um, I hope to unlock the site. Or “ET RBN Known Russian Business Network IP group 170” is an argument for blocking?
Thanks for the quick response =)

9
Um, I hope to unlock the site. Or "ET RBN Known Russian Business Network IP group 170" is an argument for blocking?
probably not ....but URLs on that IP range are suspicious

anyway your new IP was not on any blacklists as i could see … does avast block it ?

10

You’ll need to find a place w/o a Russian Business IP. Or I don’t it will be unblocked.

11

Avast! blocks as URL: Mal (Same IP Warning type thing)

12

Report it here http://www.avast.com/contact-form.php (select subject according to Your case)
you may give a link to this topic in case they reply here