False Positive JS:ScriptIP-inf and URL:Mal

system · 2017-01-07T07:17:21.000Z

Hi team and all,

Happy New Year and all the best!

So: Avast blocks my site hxxp://type2diabetestreatment.net because of positive JS:Script-inf and URL:Mal

The site is absolutely clean.
Please whithelist it.

Thanks a lot in advance.

Eddy · 2017-01-07T08:25:54.000Z

URL:Mal is never a false positive.
As has been explained many times already, it means the domain and/or IP is blocked and that is true or you would not see the message.

Blacklisted IP (Phishing) :
https://www.virustotal.com/en/ip-address/148.163.92.69/information/

Blacklistings on that ASN :
http://urlquery.net/report.php?id=1483777760699

Wordpress issues :
Warning User Enumeration is possible
The first two user ID’s were tested to determine if user enumeration is possible.
ID User Login
1 Dr. Roy Taylor secret-guide-revealed
2 None

Vulnerable library :
http://retire.insecurity.today/#!/scan/8ebaa061d958fa9afce5662f0cdcc78e80588c76d78251bee06ecc50c446b52c

Other things :

The ad pop-up must go.
Site is also giving false information.

system · 2017-01-07T11:49:01.000Z

Thanks. But

I purchased this domain a short while ago and cannot accept responsibility for the past owners. Additionally: NOT the past owner of my domain did pishing but a completely other domain. Why do block MY domain??? It is on this server just 2 weeks!
This IP is the IP of my hosting provider. And because of this you block my site??? Nobody can switch a hosting provider every day
3 Pop-up must go? In this case you have to block the whole internet!
Site is giving the false information? Which one? And you have to block the whole internet in this case as well.
What is user enumeration and why should it be bad?
How can I remove Vulnerable library ? My WP theme includes this. And again – you have to block the whole internet because of this.

So: please remove this FALSE positive

Eddy · 2017-01-07T12:09:43.000Z

As I said, it is not a false positive.

1] It is a IP block, not a domain block.
2] And ? There is malicious activity on that IP and that is why it is blocked. You can prevent this by using dedicated hosting.
5 + 6] If you have to ask, you shouldn’t be running a website or hire someone who does know how to run/setup one.

system · 2017-01-07T12:23:37.000Z

to “2] And ? There is malicious activity on that IP and that is why it is blocked. You can prevent this by using dedicated hosting.
5 + 6] If you have to ask, you shouldn’t be running a website or hire someone who does know how to run/setup one.”

Super suggestion, Eddy! I hope you have already enough money for me for using dedicated hosting and to hire someone to run/setup one!

Shame on you!

Eddy · 2017-01-07T12:27:40.000Z

With shared hosting there is always the risk the IP gets blocked if a domain on that IP is malicious.
That is the risk you took and now you see what can happen.

Pondus · 2017-01-07T12:42:47.000Z

HTML scan
https://virustotal.com/en/file/6a8c5fc62fa0981dbba3ac8a2f4dba6e591bf1a199fee471cb6156832a3ccdc4/analysis/1483792808/

There seems to be a script on the website that loads a blacklisted URL or content from a blacklisted URL

system · 2017-01-07T13:11:09.000Z

On my site? Can it be the script on the hosting itself?
How can I find out what script does this?

Thanks again.

Eddy · 2017-01-07T13:19:38.000Z

Yes, it is on your site.

Delete the scripts on it one at a time and run a scan on each time you have removed one.
Start with removing the pop-up ad.

system · 2017-01-07T13:28:19.000Z

to “run a scan on each time you have removed one”

Eddy, you mean a scan using virustotal?
If yes - have I to scan my main URL?

Thanks

polonus · 2017-01-07T14:28:29.000Z

Hi tm0 & Eddy,

This is also a problem:

WARNING: Found mail servers with inconsistent reverse DNS entries. You should fix them if you are using those servers to send email.

Server IP PTR (Reverse) IPs
-type2diabetestreatment.net. 148.163.92.69 -we.love.servers.at.ioflood.com. 96.45.82.184, 96.45.83.17, 96.45.83.217, 96.45.82.85

All mail servers should have a reverse DNS (PTR) entry for each IP address (RFC 1912). Missing reverse DNS entries will make many mail servers to reject your e-mails or mark them as SPAM.

All IP’s reverse DNS entries should resolve back to IP address (IP → PTR → IP). Many mail servers are configured to reject e-mails from IPs with inconsistent reverse DNS configuration.

Then we a B-status here: https://sritest.io/#report/6a9a460a-3e51-4edb-aec2-addc59be4dda

polonus

system · 2017-01-07T14:46:43.000Z

Thanks, Polonus, for this advice.
But now I’m lost and don’t know what to do…

polonus · 2017-01-07T15:21:40.000Z

Should be taken up with fabulous dot com - domain name phishing and spam abuse…

Observed subdomains
-www.type2diabetestreatment.net
-karaktervolhaitula.type2diabetestreatment.net
-bolsevikkejeprealistisiin.type2diabetestreatment.net
-koersla.type2diabetestreatment.net
-enmesh1-parmacety.type2diabetestreatment.net
-narcissique.type2diabetestreatment.net
-railstunshapesvleesboom.type2diabetestreatment.net
-obstruer.type2diabetestreatment.net
-jetslag-multiplicaties.type2diabetestreatment.net
-purppurivalssi-fed0.type2diabetestreatment.net

But wait for an Avast Team Member to explain the abuse to you, and why site or IP has become blocked
and site is shown as dangerous by AOS!

Also consider: https://www.virustotal.com/nl/domain/fabulous.com/information/
avast detects JS:HideLink-A [Trj] there. fabulous dot com is your registrar!

polonus (volunteer website security analyst and website error-hunter)

system · 2017-01-07T15:45:11.000Z

But Fabulous.com is one of the biggest domain registrars worldwide!

Now I don’t understand anything…

Eddy · 2017-01-07T16:51:10.000Z

Start learning and for now find someone who does have relevant knowledge and let him/her help you to solve the problems.
And yes, it can be you need to get paid help.

system · 2017-01-07T17:16:11.000Z

Eddy, maybe the paid help is my need, but I don’t have the money for. Please spare such the advises for you. Better give a report why the domain was blacklisted.

Thanks.

Eddy · 2017-01-07T17:20:16.000Z

We already told you why the IP is very likely blocked.

If you don’t have the money for a hired help, start learning (fast) and solve the problems yourself.

There really isn’t anything we can do as we do not have access to that server and your settings.

polonus · 2017-01-07T17:46:21.000Z

Let us wait for an Avast Team Member to comment the situation.
But it seems that there are issues:
https://mxtoolbox.com/domain/type2diabetestreatment.net/ 1 error and 8 warnings.

polonus

system · 2017-01-07T19:20:42.000Z

Thanks, guys, for the information.
Now I will setup a completely fresh WP and will see if Avast will find some suspicious scripts.
And we wait for an Avast team response.

system · 2017-01-08T04:38:24.000Z

I deleted all files on my domain, all databases and installed a fresh WP.
There is nothing more what should have the HTML:Script-inf on virustotal.

But Avast shows it.

So: It cannot be my site! WP itself infected?

Announcements