AGoel Posted March 9, 2017 ID:1107297 Share Posted March 9, 2017 Hi there, My website, hxxp://www.gmass.co, is an email marketing plugin for Gmail and G Suite. This morning I have users telling me that Malwarebytes is blocking access to the site, declaring it malicious. Because GMass is an email marketing tool, we do handle click-tracking redirects and occasionally a phisher will use GMass to redirect to a phishing form. We disable the redirects when we become aware of them. If you know of a redirect from GMass to a phishing form, please let me know and I will disable the redirect right away. Still though, can you tell me what I need to do to get gmass.co off your blacklist? Link to post Share on other sites More sharing options...
AGoel Posted March 9, 2017 Author ID:1107302 Share Posted March 9, 2017 To the Malwarebytes admins: I did just notice a bunch of abusive users using GMass to send emails with a link to a Gmail phishing site, where they were attempting to collect Gmail logins. I just disabled 120 user accounts, which will also disable their click-tracking redirects. I hope you can see that the problem has been resolved on my end and will unblock my IP. Link to post Share on other sites More sharing options...
Staff Zynthesist Posted March 9, 2017 Staff ID:1107303 Share Posted March 9, 2017 (edited) Hello, Details about the block: https://www.virustotal.com/en/ip-address/52.24.191.80/information/ https://www.virustotal.com/en/url/b17fb6b7dd565ee90ec64938fc2b3ecc38d3dadc8c8db65d7993516ae199dd17/analysis/1489079137/ Edited March 9, 2017 by Zynthesist Link to post Share on other sites More sharing options...
AGoel Posted March 9, 2017 Author ID:1107305 Share Posted March 9, 2017 Thanks for the info. It doesn't make much sense to me though. The flagged URL is: http://gmass.co/blog/google-sheets-integration-is-live/ which is just a blog post, and isn't capable of redirecting to anything malicious. Link to post Share on other sites More sharing options...
AGoel Posted March 9, 2017 Author ID:1107311 Share Posted March 9, 2017 Thanks for the additional link: https://www.virustotal.com/en/ip-address/52.24.191.80/information/ I've examined that as well. We have our users set up their own tracking domains and CNAME them to gmass.co, which is why so many domains are listed under "Passive DNS Replication" and "Latest Detected URLs". Still though, none of those URLs are currently malicious and I believe I've disabled all redirects to malicious content. Can anyone point me to a single URL on my server that is still malicious? Link to post Share on other sites More sharing options...
Staff Zynthesist Posted March 9, 2017 Staff ID:1107312 Share Posted March 9, 2017 I am going to remove the block. Link to post Share on other sites More sharing options...
Recommended Posts