Jump to content

False Positive - Alchemer


Go to solution Solved by JPopovic,

Recommended Posts

Hello,

My name is Calum Johnson and I am a Technical Support Representative and on the Anti-Phishing for Alchemer.

We are an online survey company that sends email campaigns and provides survey links on behalf of our customers.      One of our customers who uses you is reporting that a lot of their links are not working because our domains: app.alchemer-ca.com, .i.alchemerca.com, https://app.alchemer.com appear to be calculated as false positives on your site.

In cases where we detect a dirty email list we notify the customer, and for any repeat instances we remove their email privileges. We also shut down any account associated with phishing that was created illegally.

We do everything we can to communicate proper double opt in protocols to our customers and will continue to do so. We respond to any bbl in a timely manner and are working on improving our response time as we move forward.     

Thank you for removing our domain!

Calum

Link to post
Share on other sites
  • Staff

Hello Calum,

I think it's being flagged due to this path. Does it belong? 

https://survey.alchemer-ca.com/s3/50104446/2021-Shared-Secured-Documentation-Microsoft-Outlook

This one too:

https://survey.alchemer-ca.com/s3/50104106/Microsoft-Secured-Document-Encrypted-File

https://www.virustotal.com/gui/url/e2125034da4eb4e2f692a1a511918082b39042a566f2307e0140e2acd40ca891/detection

 

Link to post
Share on other sites

Hello,

Thanks so much for sending those over!

I was able to track down the source of those phishing links and shut down the accounts associated. This will stop them from creating more phishing surveys and also purged all of the data that's been collected. 

Could you let me know when we're no longer flagged? Thank you!

Calum

 

Link to post
Share on other sites

Hello thisisu,

 

Could you please let me know if you're still flagging our domains? I have Alchemer users reporting they're running into more security errors and I want to make sure the flagging isn't coming from here.

 

Thank you!

Link to post
Share on other sites
25 minutes ago, CalumJohnson said:

Hello thisisu,

 

Could you please let me know if you're still flagging our domains? I have Alchemer users reporting they're running into more security errors and I want to make sure the flagging isn't coming from here.

 

Thank you!

From just me going to those links you posted, there are no blocks.

Link to post
Share on other sites
  • Staff

I do not see any blocking of the domains you have listed.

Link to post
Share on other sites
  • Staff
  • Solution

Hello Calum,

The only subdomain we block is survey.alchemer-ca.com.

It was blocked due to phishing links, but since you have removed them, the block will also be removed.

Thank you for your understanding!

Link to post
Share on other sites
16 minutes ago, CalumJohnson said:

How can I remove this block? Are there any other phishing links using that domain?

Staff will do that.

Which exact domain? This info would help track it down.

Edited by Porthos
Link to post
Share on other sites
  • Staff

Funny you should ask.  (Sorry...weird day so far).  The phishing block is being removed.  Please allow 2-4 hours for changes to take effect.  A reputation block that would have remained has been proactively removed so that once the phishing block is lifted, you will be in good shape.

Link to post
Share on other sites
  • Staff

I have just been told that the following phishing link is live. I need to put a block back on until your site can be verified as clean:

http://survey.alchemer-ca.com/s3/50110072/Shared-Secured-Documentation-Encrypted-File

Link to post
Share on other sites
  • Staff
54 minutes ago, CalumJohnson said:

Hello,

Would you mind checking again? This link and the account associated has been shut down and the data has been purged!

Thank you!

Hi, sorry about the delay. Remaining blocks have been removed. Once a database update goes out you should no longer see the detection.

Link to post
Share on other sites
  • Staff

Verified that block is no longer in effect.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.