Blocked Site - Trojan - DDNS

[TinxTecnologia]

Hello there!

1) Our company deploys a utility for remote support, based on VNC (RFB protocol).

2) The utility can be found here: www.suportedireto.com.br/demo , and there are a plenty of versions, one for each customer.

3) Each customer has their .EXE version, with branding and support contact info (see attached image gallery)

4) Each app has it's own DDNS built in, pointing to <SOMEHOST>.suportedireto.com   (this time without .BR)

5) When a customer uses our APP with MalwareBytes active, it detects the app as a Trojan, during connection to HTTP, as we can see on attached screenshot.

6) Since we use DDNS, there is no fixed IP we can provide to try to whitelist.

7) there is also attached one txt log 

8) there is no specific TCP port, some users have 443 port available, other 4020, 4021, 6001, 6002 and others.

 

Currently we ask users to deactivate MalwareBytes temporarily, but this is not a good practice.

Please let us know how can we solve this issue!

demo_suportedireto_com_false_positive.txt

[thisisu]

Hi TinxTecnologia,

The block will be removed in the next update. Sorry for the inconvenience

Thanks for reporting