More info on MB Browser Guard warning on washingtoncountyinsider.com

[esman01]

Can you provide more info on the possible malware activity and blacklisting of www.washingtoncountyinsider.com website? I have notified the owner of the website, but their web host has not rectified the problem. I would like to provide them with more information. My family uses this site for local news, obituaries, etc... and we are getting frustrated with it being blacklisted.

The error message is 

Website blocked due to reputation

Website blocked: www.washingtoncountyinsider.com

Malwarebytes Browser Guard blocked this website because it may contain malware activity.

[Porthos]

2 minutes ago, esman01 said:

My family uses this site for local news, obituaries, etc... and we are getting frustrated with it being blacklisted.

Since you are a Techbench member I will add this. Browser guard is pretty aggressive and will have some false positives due to that.

It is not just a "block list" but uses different heuristic algorithms as well.

[esman01]

Thank you Porthos. It might be a false positive, but it could also be a legitimate issue. Several sites on VirusTotal have flagged it too, but that could be based off of 1 false positive. As I stated, I would like to help them get it resolved. Thanks again for your assistance with this.

[Porthos]

Could be it shares an IP with this site.

Quote

Google Safe Browsing: Malicious for washingtoncountyinsider.com

Current DNS A record: 104.27.129.78 (AS13335 - CLOUDFLARENET, US)

https://www.virustotal.com/gui/url/4c07e31905fb8127041b5efef839bddcf981b9832bd5a4e38ec2f8884ac2ce87/detection

[Porthos]

Staff will do their own research soon.

[esman01]

Interesting that the other site is flagged on VirusTotal by Fortinet, Kaspersky, SCUMWARE.org, and Sophos AV whereas this site was flagged by CRDF, CyRadar, Emsisoft, G-Data, Netcraft, and Forcepoint ThreatSeeker. 

[gonzo]

I do not have access to in-depth research tools that would allow me to make good recommendations, so I cannot help you there.  I did refer it to our web research team (hence the delay) and they said they did not see any active threats.  I have whitelisted the site.  Please allow 15-30 minutes for changes to take effect.

[esman01]

Thank you for looking at it. Hopefully no more issues develop.

[gonzo]

A reputation block is minor. More often than not, we are being overprotective based on past history or questionable statistics.  It should be fine once the block disappears.