Homesite blacklisted

Viruses and worms
1

Hi!

My homesite www.pihlajakumpu.fi seems to be blacklisted. Files are placed on the Buffalo nas server behind the Dovado-router. I have cleaned files with the Malwarebytes anti malware and attach logs.

How long time backlisting continues?

2

You can report a possible FP here: http://www.avast.com/contact-form.php

3

I have sent many FP-reports but nothing happen!
I should at least know what I do from now, my customers really need this service.

4

Your site is hosted at afraid.org … evrything from afraid.org is blocked

Reason posted many times, search forum for afraid.org

5

Yes, Pondus is right and moreover I see sub-domain delegation errors: http://dnscheck.pingdom.com/?domain=www.pihlajakumpu.fi&timestamp=1414072451&view=1
This is why avast! blocked your site: http://dnscheck.pingdom.com/?domain=pihlajakumpu.fi&timestamp=1414072753&view=1
See under Nameserver - ns1.afraid.org; ns2.afraid.org; ns4.afraid.org.

Furthermore your header security could be much more secure:

[quote]
Result Category Name Actual Value Our Recommendation
Missing Framing X-Frame-Options Use ‘sameorigin’
Missing Transport Strict-Transport-Security Use ‘max-age=31536000; includeSubDomains’
Missing Content X-Content-Type-Options Use ‘nosniff’
Warning Content Content-Type text/html Use ‘text/html;charset=utf-8’
Missing XSS X-XSS-Protection Use ‘1; mode=block’
Missing Caching Cache-Control Use ‘no-cache, no-store, must-revalidate’
Missing Caching Pragma Use ‘no-cache’
Missing Caching Expires Use ‘-1’
Missing Access Control X-Permitted-Cross-Domain-Policies Use ‘master-only’
Missing Content Security Policy Content-Security-Policy Try Content-Security-Policy-Report-Only to start. Include default-src ‘self’, avoid ‘unsafe-inline’ and ‘unsafe-eval’
Warning Server Information Server lighttpd/1.4.32 Avoid version numbers

polonus (volunteer website security analyzer)

6

jassoo, recommendations…

7

Get a new host…

8

Yes, steer away from afraid dot org.
Report that you have done that, and an avast team member might come and unblock the site.
We aren’t avast team members, just volunteers with relevant knowledge, just into this for “the good of our souls”.

polonus

9

https://forum.avast.com/index.php?topic=144105.msg1045857#msg1045857

10

Nameserver changed!

11

Unblocked;-)!

12

Still blocked!

13

hmmm … your new IP (46.132.188.113) is blacklisted by apews.org / spamhaus.org http://whatismyipaddress.com/blacklist-check

this is what apews.org say

Entry matching your Query: E-1227047 46.128.0.0/12 CASE: C-131 Unallocated CIDR, no traffic until allocated, or allocated to bad reputation provider or allocated but dynamic / generically named IPs, or bogons, see www.cidr-report.org, or orphaned IP / CIDR in routing table History: Entry created 2014-03-10

i will PM Honza so he can have a look…

14

Actual status of the site is still blocked as with URL:Mal.

polonus

15

Hi all, thanks for reporting it. It looks like an internal error on our side, which was the reason for this specific domain to not unblock correctly:-(. I now unblocked the domain and made sure all the IPs that the domain resolves to are unblocked.
Once again, I am very sorry for the delay this caused, hopefully it will be fixed in the next VPS update (streaming update, for those who have them enabled, should be already out).

16

HonzaZ, since it was your fault…
You owe him a drink ;D

17

Hi Eddy,

I think that HonzaZ was saved by the bell and he got rewarded for following the thread here.
As an additional bonus the domain has now been moved from an untrusted nameserver to a more secure one
and eventually became unblocked, so everybody should be happy now. :wink:

polonus

18

Thanks! works fine now.