False site block

Viruses and worms
1

hi avast!
I just created site for minecraft server, first time site has been hosted on free web hosing but after 2 mounth we start using normal web hosting. After 2 week after creation this site (http://sapiunt.ru) Site has been blocked by avast! Why? I sent 4 emails to your support in 3 mounths from my email (giganty@yandex.ru) and they been totaly ignored.

I have tested on all the sites I could find and it says that it’s clean…

https://www.virustotal.com/url/b0dc2c29dbfa2fe24b0c6267c4f6002e395a5ed8c4fce519367ef308c66ea69d/analysis/ - Virus Total
http://www.urlvoid.com/scan/sapiunt.ru/ - UrlVoid

2

Probably reported as spam domain → http://knujon.com/ips/109.68.190.12.html
Worm.Dorkbot botnet controller @109.68.191.131 on that range
This is pointing to a general IP block: http://www.scumware.org/report/109.68.190.12
and http://hosts-file.net/default.asp?s=109.68.190.12

polonus

3

Really dont know about it, but this ip has been used by 2 sites, and they has been kicked from this IP. Now we bought our ip in hosting http://www.mgnhost.ru. Can you unblock this domain?

4

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles

polonus

5

Already sent message 3 mounths ago, but dont have answer so far.

6

2 domains on that IP detected: http://www.urlvoid.com/scan/sapiunt.ru/
Consider content after the < /html> tag should be considered suspicious.

585: < !-- DataLife Engine Copyright SoftNews Media Group (http://dle-news.ru) → Read: http://www.metagenerator.info/generator-details.html?gid=1045
The data on this site is collected through a crawler named MetaGeneratorCrawler. It visits the entrypage of every linked domain or subdomain regardless, where the link points on the crawled site.

The goal of this site and crawler is, to collect some data, which generators are used through the web. The country level domains give an extra information, how the software is spread around the world.

If you do not whish, that the crawler visit your site again, feel free to add the following line to your robots.txt:
User-agent: MetaGeneratorCrawler
Disallow: /

Attackers could also like to have that info?!?

polonus

7
2 domains on that IP detected: http://www.urlvoid.com/scan/sapiunt.ru/
Its old information, really, try to access to this domains.
585: < !-- DataLife Engine Copyright SoftNews Media Group (http://dle-news.ru) -->
Its copyright of CMS creators DataLife Enigie. Look http://dle-news.ru

So, you can to unblock this domain?

8

Did you file up the fp report. I cannot unblock, avast team members can do this for your domain, and so it is up to them.
In broken links I get several going to for instance that are spam links (Processed 1387 web pages, found 53 broken links)
htxp://www.maleenhancementhq.com]maleenhancementhq.com[/url]
htxp://acheter-c i a l i s-pascher.net/>SPAM
htxp://makspol.ru/]%D0%A1%D0%B4%D0%B0%D1%82%D1%8C (kriptonoid obfuscated)
hxtp://wXw.mebel-story.ru/]panamar
%D0%92%D0%BE%D0%B7%D0%B2%D1%80%D0%B0%D1%89%D0%B5%D0%BD%D0%B8%D0%B5 (special site map)

polonus