MapTile.org - False Positive

Viruses and worms
1

Avast is reporting “malware” on my website: maptile.org. It is the only website at the ip.

So far I haven’t been able to get an example of a single URL or file that is infected. I suspect a false positive.

I’m a website developer (php/mysql) with ten years of experience. This website is being used to host 160 GB of data and map tiles for a project called JusticeMap.org - a map of race and income based on US 2010 Census Data. My tile layers work with Google Maps.

The website has
-3 html files - all very basic
-1 .htaccess file - two lines long (has to do with supporting kmz - google earth files)
-a couple million images - 256 x 256 map tiles that I created using TileMill
-several very large .mbtiles files - created using TileMill
-several very large zip files (up to 10 GB) - some of them include image tiles, and some of them include a copy of my census data (in postgres format).

My last email from Avast said:
“Detection is correct, shared IP with infected sites. You have to contact registrar.”

I responded to ask for an example of a file or URL that is infected.

2

It appears to be reporting a redirector

Example of the alert

3

Only get a URL:Mal detection there from avast! Webshield…
Name of the game and cause of blocking DNS on ns1 dot afraid dot org!
That is a general detection. Consider this DNS report: http://dnstoolkit.net/nslookup/maptile.org
When you change away from being on afraid dot org avast could reconsider to lift the blocking,
but that is up to an avast! team member, like Milos for instance.
In the case you changed your DNS you could report for unblocking here: http://www.avast.com/contact-form.php

polonus aka Damian

4

Thanks for this information.

Why is using afraid.org for DNS wrong? I’ve got it setup so only I can use the domain. It is setup with the “private” option.

Is the problem that Avast cannot detect that I’m using the private option?

Is CloudFlare DNS a better option?

5

Hello,
Either your DNS host allows creation of subdomains for other persons, or your passwords were stolen or the DNS host itself was hosted, but your domain was clearly used for malicious purposes and was blocked.
Any domain hosted on afraid.org can be used by other persons for dns hosting without your control. It happened for your domain, it was misused for malicious purposes - in that case, when nobody has control on subdomains of domain (DNS hijacking), we block the whole domain in order to protect our users. For you, the solution is most probably only changing the dns hosting and letting us know later.

Milos

6

Interesting.

When I checked on afraid.org they only had me using the domain. But maybe they aren’t secure or maybe someone hijacked it temporarily.

I have changed the DNS to CloudFlare. It will probably take several hours to go through.

7

Maptile.org has been removed from the list. Thanks for everyone’s assistance!

I guess you are overwhelmed with all the malware and viruses that exist, but it would be nice if you were to give website owners a little more information to help us combat malware.

It was not obvious that

  1. my website was doing anything wrong - Avast labeled it as “malware” and I saw none. So the Avast message could have been improved.

  2. that using afraid.org for DNS was wrong. The response that I got from Avast support said I was using a “redirector” which made no sense to me as I’d completely forgotten that I was using afraid.org for DNS. As most websites use DNS, it would make sense to be more specific about the problem.