Clean Website Blocked by Avast as unsafe

system · 2017-08-07T16:05:11.000Z

We have received multiple reports from users that Avast blocks a website we host, tamultihousing.com, calling it unsafe. The site is clean on virustotal.com.

We are aware of malicious traffic trying to go to tamultihousing.com, but we block it at our network perimeter. Please allow me to provide a little background:

For just a few hours on 7/31/2012 (two years, two servers, and two networks ago), tamultihousing.com/logo.gif did appear to be malicious. We deleted the file as soon as it was discovered, literally within hours of it showing up, and verified the server was not otherwise compromised. Deleting the file resulted in millions of 404s, and our previous server and network wasn’t sophisticated enough to do anything about it. The 404s were crippling so we added a clean 43 byte logo.gif to tamultihousing.com, actually serving up that small file used fewer resources than having no file at all. Once that site (verified clean) was moved to our much more sophisticated current network, we blocked that traffic at the firewall.

Except for a few hours in 2012, tamultihousing.com (and everything else we host) has been clean, but the bot traffic still returns on occasion (our network security admins are alerted via our checkpoint firewall). Logo.gif for three hours in 2012 was the last and only malicious anything we ever found on our servers ever. We believe the file got there in the first place via a vulnerability in the Plesk control panel we had on that old box, which we were happy to be rid of in late 2012.

We have no control over this rouge, outside Sality traffic that likes to try and ping that domain on occasion, all we can do is block it at the firewall which we’ve done for years. Is there any process to get that domain back to a neutral status with Avast?

Pondus · 2017-08-07T16:13:11.000Z

The site is clean on virustotal.com

The word clean is a bit misleading as virustotal does not scan the website for infections, it is a blacklist check

Something you can fix >> http://retire.insecurity.today/#!/scan/a54bffccf22ca015426e0b1abdc7fa0809fb92b2b90a4a47f9f22c46abc4d5fb

system · 2017-08-07T16:36:54.000Z

Did not mean to mislead - to rephrase, the site has a detection ratio of 0/65 on virustotal.com and has zero threats detected when virus scan is run on the server.

We have updated the jquery library and now shows no vulnerable libraries found:

http://retire.insecurity.today/#!/scan/26d16691e7d8bb03ccb812ff5f54c3eaf47a1c0d01278f14b7577d2588744580

Back to my original question, what recourse does a website owner/operator have to remove an unwarranted block from Avast?

Pondus · 2017-08-07T17:30:23.000Z

Did not mean to mislead

You did not ... Virustotal does when using the word clean, would be better if they said Not Blacklisted

Avast lab is notified

Back to my original question, what recourse does a website owner/operator have to remove an unwarranted block from Avast?

https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

Milos · 2017-08-08T07:52:47.000Z

Hello,
the domain was unblocked.

Milos

system · 2017-08-08T18:28:52.000Z

Thank you all for your help.

system · 2017-08-23T19:51:00.000Z

Milos post:5:

Hello,
the domain was unblocked.

Milos

We’re still getting reports of false positive blocking of content at our clean domain (see above for background/context) tamultihousing.com. How can we get it unblocked? We have no control over the Sality traffic that’s causing the block other than block it at the firewall which we’ve done for years. Thanks everyone for the help.

This is an email with embedded content from the domain:

http://www.reactionweb.com/help/mike/2017-08-23_1344.png

polonus · 2017-08-23T20:54:07.000Z

This uri is being blacklisted, and not only by avast but also by Fortinet’s: -www.tamultihousing.com/logo.gif?1c71b=1048563
There is a HTTP/1.1 307 Temporary Redirect to -https://guestportal20.costar.com/UserCheck/PortalMain?IID=303D094F-AC8E-4990-F0F8-E7EB48F72DE1&origUrl=aHR0cDovL3RhbXVsdGlob3VzaW5nLmNvbS9sb2dvLmdpZj8xYzcxYj0xMDQ4NTYz
now resolving to 0.0.0 → http://toolbar.netcraft.com/site_report?url=http://www.costar.com
Host name:
a23-79-156-150.deploy.static.akamaitechnologies.com
Not secure Symantec Class 3 EVSSL CA - G3 cert. - http://toolbar.netcraft.com/site_report?url=http://a23-79-156-150.deploy.static.akamaitechnologies.com

polonus

Eddy · 2017-08-23T20:57:40.000Z

How can we get it unblocked?

Why asking ? You have already been told.

Announcements