Possible false positive on web shield

system · 2017-06-27T07:05:37.000Z

Hi everyone,
I got an issue last night where Web shield is reporting the following when opening up Safari on Macbook Pro 2017 running the latest MacOS. The following alert shows when even on the standard Safari default homepage without navigating anywhere. Any help on this would be great Thanks

Infection Blocked
Infection: URL:Mal
For URLS:
hxxp://www.julienrenvoye[.]com/apple-touch-icon.png
hxxp://www.julienrenvoye[.]com/favicon.ico
hxxp://www.julienrenvoye[.]com/apple-touch-icon-precomposed.png
hxxp://www.julienrenvoye[.]com/apple-touch-icon.png

Process: /Applications/Safari.app/Contents/MacOS/Safari

Action Taken to fix the issue
Running full avast scan shows system is clean.
Running Malwarebytes Anti-Malware shows system is clean.
Changing homepage in safari to google.com did not solve the issue.
Eventually found switching off some plugin loading options in safari and extensions stopped the alert. Please note that this is a new machine and no plugins or extensions for safari have been installed.

As I said I’m leaning to this being e a case of a false positive. Going to the hxxp://www.julienrenvoye[.]com does not show up any issues on windows PC running Endpoint Antivirus. Anyone else encountered this URL before. (Oh and I have never visited the url in question)

Eddy · 2017-06-27T07:10:26.000Z

The domain/IP is blacklisted.
Not surprisingly with that many domains on the same ASN/IP.

https://www.virustotal.com/en/ip-address/103.224.182.252/information/
http://urlquery.net/report.php?id=1498545411064

Milos · 2017-06-28T08:00:05.000Z

Hello,
can you post a screenshot of the Avast detection window, please?

Milos

Announcements