https://ceasattachments.com

[REGITDept]

Dear Malwarebytes,

Whenever we went to this website "https://ceasattachments.com". Malwarebytes would pop-up with a block "structurecdn.thememove.com(204.48.23.106:65017)".

Please let us know whether this is a false positve or malicious?

Thanks.

[Porthos]

9 minutes ago, REGITDept said:

Dear Malwarebytes,

Whenever we went to this website "https://ceasattachments.com". Malwarebytes would pop-up with a block "structurecdn.thememove.com(204.48.23.106:65017)".

Please let us know whether this is a false positve or malicious?

Thanks.

I am not seeing a block on that site. Could you post the log showing the block.

[REGITDept]

4 minutes ago, Porthos said:

I am not seeing a block on that site. Could you post the log showing the block.

Please see screenshot.

P.S: We are using Malwarebytes Cloud.

Thanks.

[Porthos]

I do see the block in Browser guard.

 

[REGITDept]

1 minute ago, Porthos said:

I do see the block in Browser guard.

 

So what is your verdict on this one? A false positive or what is the reason it was blocked in this case?

Thanks.

[Porthos]

Just now, REGITDept said:

So what is your verdict on this one? A false positive or what is the reason it was blocked in this case?

We just have to wait for staff to respond. I was just adding more info for them.

[gonzo]

The site shown in red is currently flagged as a Trojan.  I have submitted it for review.  If they say it is a Trojan, it will continue to be blocked.  More when I know more...

[gonzo]

Block is being removed, but it will take as much as 3-4 hours before changes take effect.

[REGITDept]

40 minutes ago, gonzo said:

Block is being removed, but it will take as much as 3-4 hours before changes take effect.

Thank you.

Is it a false positive?

Thanks.

[gonzo]

It was blocked as a Trojan one month ago, then unblocked today after review.  Not knowing whether it was classified as a Trojan by manual or automatic means, its hard to tell.

[REGITDept]

Issue confirmed fixed.

Thanks all.