False positive for a work system site.

Viruses and worms
1

Hi.

I have tried sending in a false positive report for a site several weeks ago, but nothing has happened (or no update has taken care of it yet).

The domain affected is: http://publishbit.com (IP: 52.18.66.59)

The server owner says they have re-installed the whole system a couple of weeks ago, but I’m still not able to access it. Currently they have to send my work outside of the system for me to be able to do it (it’s a CMS for translation jobs).

There were other Avast users with the same problem before, but some of them should be able to work again so I’m surprised that my system is still blocking the site.

Is there anything more I can do besides waiting for an Avast update?

2

→ http://zulu.zscaler.com/submission/show/8c26c7341eaa0ab6bd5bb4f23ab13340-1442826882

You can report a possible FP here: https://www.avast.com/contact-us.php?subject=VIRUS-FILE

3

Excessive headers: Warning

Requested URL: -http://publishbit.com/ | Response URL: -http://publishbit.com/ | Page title: Publishbit Login | HTTP status code: 200 (OK) | Response size: 4,933 bytes (gzip’d) | Duration: 172 ms
Overview
By default, excessive information about the server and frameworks used by an ASP.NET application are returned in the response headers. These headers can be used to help identify security flaws which may exist as a result of the choice of technology exposed in these headers.

Result
The address you entered is unnecessarily exposing the following response headers which divulge its choice of web platform:

Server: Apache/2.4.16 (Amazon) PHP/5.6.12 _http-server-header: Apache/2.4.16 (Amazon) PHP/5.6.12
X-Powered-By: PHP/5.6.12 → https://msisac.cisecurity.org/advisories/2015/2015-091.cfm
OpenSSH 6.2 (protocol 2.0)

It looks like a cookie is being set without the “HttpOnly” flag being set (name : value):

PHPSESSID : cenkp45irqe2bm6e0bosasq0f3
Unless the cookie legitimately needs to be read by JavaScript on the client, the “HttpOnly” flag should always be set to ensure it cannot be read by the client and used in an XSS attack.

It doesn’t look like an X-Frame-Options header was returned from the server which means that this website could be at risk of a clickjacking attack. Add a header to explicitly describe the acceptable framing practices (if any) for this site.

Netcraft Risk Status: http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Fpublishbit.com

Bad web rep domain on same IP: https://www.mywot.com/en/scorecard/aspiso.ru?utm_source=addon&utm_content=popup

AngularJS v1.1.5 may be vulnerable to Cross-Site-Scripting: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fpublishbit.com → http://www.hpenterprisesecurity.com/vulncat/en/vulncat/java/javascript_hijacking_vulnerable_framework.html

I think your site became reported because of abuse by other domains on that same Amazon IP from Dublin.
You could ask Avast to exclude your doamin on that specific IP. We cannot do this for you here, because we are general forum volunteers with relevant knowledge, but unblocking can only be performed by Avast Team members and we here are not.

polonus (volunteer website security analyst and website error hunter)

4

IP history https://www.virustotal.com/en/ip-address/52.18.66.59/information/

5

Pondus is spot on - we block the whole IP (52.18.66.59). Can you move your domain to another IP?

6

Thanks all of you. :slight_smile:

It’s not my own domain but one of my clients who I do translations for. I’ll send them this information right away to let them know about the issues.