HTL Posted October 5, 2017 ID:1169896 Share Posted October 5, 2017 One of the buttons/ links on our company website has started being flagged as a malicious website "co.com" about 2 mths ago. Is this truly a malicious website or can it be considered as a false positive by your team. Logs are below. Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 10/5/17 Protection Event Time: 8:49 AM Log File: aca618b8-a9cb-11e7-a1fb-a4c4943c9537.json Administrator: Yes -Software Information- Version: 3.2.2.2018 Components Version: 1.0.207 Update Package Version: 1.0.2955 License: Premium -System Information- OS: Windows 10 (Build 15063.608) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Domain: www.co.com IP Address: 173.192.76.171 Port: [53862] Type: Outbound File: C:\Program Files (x86)\Internet Explorer\iexplore.exe (end) Link to post Share on other sites More sharing options...
HTL Posted October 6, 2017 Author ID:1170242 Share Posted October 6, 2017 One of the buttons/ links on our company website has started being flagged as a malicious website "co.com" about 2 mths ago. Is this truly a malicious website or can it be considered as a false positive by your team. Logs are below. Thank You Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 10/5/17 Protection Event Time: 8:49 AM Log File: aca618b8-a9cb-11e7-a1fb-a4c4943c9537.json Administrator: Yes -Software Information- Version: 3.2.2.2018 Components Version: 1.0.207 Update Package Version: 1.0.2955 License: Premium -System Information- OS: Windows 10 (Build 15063.608) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , , Blocked, [-1], [-1],0.0.0 -Website Data- Domain: www.co.com IP Address: 173.192.76.171 Port: [53862] Type: Outbound File: C:\Program Files (x86)\Internet Explorer\iexplore.exe (end) Link to post Share on other sites More sharing options...
MysteryFCM Posted October 6, 2017 ID:1170256 Share Posted October 6, 2017 The cause was several malicious sub-domains. These have been re-checked and are now suspended. The block will be removed on the next update. Link to post Share on other sites More sharing options...
Recommended Posts