False positives on coreims.co.uk and sub domains

[CoreimsLtd]

We are seeing website blocking false positives on all out subdomains.

Our server antimalware reports no issues (including when scanned with Malwarebytes).

Please remove the block.

[thisisu]

Hi,

The block will be removed in the next update. Sorry for the inconvenience

Regards

[CoreimsLtd]

Thank you,

can you provide any insight into why this was blocked or which subdomain triggered the block?

I would like to pass this back to our SOC so they can address whatever was triggering the false positive.

[thisisu]

I'm asking about it. I suspect it was this file that triggered the block but I'll let you know if it was something else: https://www.virustotal.com/gui/url/137d336094039a0d103b62d3cd1bd0ade76d20798cc242d0afc7169981b4232b/detection

[CoreimsLtd]

That's helpful thank you

[Dashke]

12 hours ago, CoreimsLtd said:

That's helpful thank you

Hi, the block was put because of this file -

coreims.co.uk/xxx

but it seems unavailable now.

Thanks!

Edited September 21, 2020 by Dashke
removed the link

[CoreimsLtd]

Thank you very much for the confirmation. Apparently that was a false positive on a winrar self extractor (file was clean according to on-demand scans using Malwarebytes, Sophos, Trend etc). We have replaced with a 7zip self extractor with the same name and similar functionality to try to avoid future false positives.

This is not a URL we publish so if you could edit your post to remove the path that would be very helpfuly.

[Dashke]

Thanks for the explanation, the link has been removed.