False positiv: our website on your blacklist

system · 2015-08-24T14:22:50.000Z

We have a false positive every time we try to view a web page from any fluidstream.it subdomains.
We get the error accessing to:
www.fluidstream.it
players.fluidstream.it
players1.fluidstream.it

We have checked them with www.urlvoid.com e virus total and they are reporting no problems.

Please, this is creating great problem to our company, users using Avast are not able to view our web pages.
And we have problem with the reputation of our company, we’re an affordable company and it’s not good for the customers to see that Avast is saying that our web sites are dangerous.

Please, could you check it and tell me why we are getting these false positive messages from your antivirus?

Please, it’s urgent…
Thanks for your help and regards

Nadia

Pondus · 2015-08-24T14:30:54.000Z

could be a IP block …

IP history https://www.virustotal.com/nb/ip-address/213.186.33.169/information/
multiple domains on same IP and many are blacklisted … click more button under list(s) for more info

IPvoid http://www.urlvoid.com/ip/213.186.33.169

[b]IP ADDRESS: 213.186.33.169[/b]
We have found in our database of already analyzed websites that there are 91 websites hosted in the same web server with IP address 213.186.33.169 and IP hostname full-cdn-01.cluster014.ovh.net. Remember that it is not good to have too many websites located in the same web server because if a website gets infected by malware, it can easily affect the online reputation of the IP address and also of all the other websites.

Pondus · 2015-08-24T14:37:48.000Z

If you think it is wrong, report it here https://support.avast.com → avast virus lab

system · 2015-08-24T14:40:54.000Z

The ip 213.186.33.169 is owned by OVH and is hosted on a shared hosting plan.
I don’t know how many domains are hosted on their servers, it’s an OVH problem.
The only thing that I know is that our domain is not infected by any malware and we’re not present in any blacklist.

Another point: player1.fluidstream.it is hosted on another server, another provider, on a dedicated vps and it is blocked by Avast.

So, please could you remove our fluidstream.it domains from your blacklist?

Nadia

system · 2015-08-24T14:47:45.000Z

I’ve tried to contact them https://support.avast.com → avast virus lab with no answers.

Pondus · 2015-08-24T14:52:24.000Z

Nadia68 post:5:

I’ve tried to contact them https://support.avast.com → avast virus lab with no answers.

It may take some time …

The only thing that I know is that our domain is not infected by any malware and we're not present in any blacklist.

It does not have to be infected, there are other reasons

IP is on 5 blacklists here http://multirbl.valli.org/lookup/213.186.33.169.html seems to be spam related

system · 2015-08-24T15:01:37.000Z

I think that Avast should block only spammers or infected domains and not all the domains hosted on a server where is present an infected domain.
Our domain is not related to any infected or spammer domains.

We’re having serious reputation damages with our customers.

Nadia

Pondus · 2015-08-24T15:04:22.000Z

I did not say that was the reason why avast block it. Only avast lab can tell you why, so you have to wait for a reply to your ticket

if you post your ticket number here we can try to speed it up … no guaranty

system · 2015-08-24T15:22:27.000Z

I’ve just received an answer from Avast team, now they will check the issue with their technicians.
I don’t think it’s a ip address problem, because other domains hosted on the same ip are not blocked.

Nadia

Pondus · 2015-08-24T15:36:48.000Z

HonzaZ · 2015-08-25T05:11:04.000Z

What about
veronica01.fluidstream.it
nostalgia.fluidstream.it
Are these your domains?

system · 2015-08-25T08:26:59.000Z

They are both ours.
They are only a dns record to our audio/video streaming servers, there is no infections (checked them with virus total).
The dns is not hijacked.
What do you see wrong on that domains?

Nadia

HonzaZ · 2015-08-25T08:46:23.000Z

Just that the names are suspicious and they pointed to a different IP than the rest of your subdomains - this usually points to a dns hijack. As this is not the case, I am unblocking your domain ;-)!

Pondus · 2015-08-25T09:21:30.000Z

there is no infections (checked them with virus total).

VirusTotal does mot scan website for infections, it is a blacklist check

For infection check use
Killmalware.com
Sitecheck.sucuri.net
Unmaskparasites.com

system · 2015-08-25T09:55:40.000Z

Thank you HonzaZ,

we have serious problems with our customer, please let me know when the block will be removed.

Nadia

PS: thanks Pondus

HonzaZ · 2015-08-25T10:05:17.000Z

I already unblocked it - you should not receive any warnings if your Avast is updated

system · 2015-08-25T22:05:12.000Z

Thanks guys

Nadia

Announcements