CalumJohnson Posted May 10, 2021 ID:1456073 Share Posted May 10, 2021 Hello, My name is Calum Johnson and I am a Technical Support Representative and on the Anti-Phishing for Alchemer. We are an online survey company that sends email campaigns and provides survey links on behalf of our customers. One of our customers who uses you is reporting that a lot of their links are not working because our domains: app.alchemer-ca.com, .i.alchemerca.com, https://app.alchemer.com appear to be calculated as false positives on your site. In cases where we detect a dirty email list we notify the customer, and for any repeat instances we remove their email privileges. We also shut down any account associated with phishing that was created illegally. We do everything we can to communicate proper double opt in protocols to our customers and will continue to do so. We respond to any bbl in a timely manner and are working on improving our response time as we move forward. Thank you for removing our domain! Calum Link to post Share on other sites More sharing options...
thisisu Posted May 11, 2021 ID:1456128 Share Posted May 11, 2021 Hello Calum, I think it's being flagged due to this path. Does it belong? https://survey.alchemer-ca.com/s3/50104446/2021-Shared-Secured-Documentation-Microsoft-Outlook This one too: https://survey.alchemer-ca.com/s3/50104106/Microsoft-Secured-Document-Encrypted-File https://www.virustotal.com/gui/url/e2125034da4eb4e2f692a1a511918082b39042a566f2307e0140e2acd40ca891/detection Link to post Share on other sites More sharing options...
CalumJohnson Posted May 11, 2021 Author ID:1456226 Share Posted May 11, 2021 Hello, Thanks so much for sending those over! I was able to track down the source of those phishing links and shut down the accounts associated. This will stop them from creating more phishing surveys and also purged all of the data that's been collected. Could you let me know when we're no longer flagged? Thank you! Calum Link to post Share on other sites More sharing options...
CalumJohnson Posted May 17, 2021 Author ID:1457501 Share Posted May 17, 2021 Hello thisisu, Could you please let me know if you're still flagging our domains? I have Alchemer users reporting they're running into more security errors and I want to make sure the flagging isn't coming from here. Thank you! Link to post Share on other sites More sharing options...
Porthos Posted May 18, 2021 ID:1457505 Share Posted May 18, 2021 25 minutes ago, CalumJohnson said: Hello thisisu, Could you please let me know if you're still flagging our domains? I have Alchemer users reporting they're running into more security errors and I want to make sure the flagging isn't coming from here. Thank you! From just me going to those links you posted, there are no blocks. Link to post Share on other sites More sharing options...
gonzo Posted May 18, 2021 ID:1457512 Share Posted May 18, 2021 I do not see any blocking of the domains you have listed. Link to post Share on other sites More sharing options...
Staff Solution JPopovic Posted May 18, 2021 Staff Solution ID:1457554 Share Posted May 18, 2021 Hello Calum, The only subdomain we block is survey.alchemer-ca.com. It was blocked due to phishing links, but since you have removed them, the block will also be removed. Thank you for your understanding! Link to post Share on other sites More sharing options...
CalumJohnson Posted May 19, 2021 Author ID:1458017 Share Posted May 19, 2021 Hello! Sorry to bother again, my user is still getting this error message: Is this just because the removal hasn't full processed yet or is there still a block somewhere? Thank you! Link to post Share on other sites More sharing options...
Porthos Posted May 19, 2021 ID:1458018 Share Posted May 19, 2021 (edited) @gonzo. Disregard Edited May 19, 2021 by Porthos Link to post Share on other sites More sharing options...
CalumJohnson Posted May 19, 2021 Author ID:1458026 Share Posted May 19, 2021 Got it! How can I remove this block? Are there any other phishing links using that domain? Thank you! Link to post Share on other sites More sharing options...
Porthos Posted May 19, 2021 ID:1458028 Share Posted May 19, 2021 (edited) 16 minutes ago, CalumJohnson said: How can I remove this block? Are there any other phishing links using that domain? Staff will do that. Which exact domain? This info would help track it down. Edited May 19, 2021 by Porthos Link to post Share on other sites More sharing options...
CalumJohnson Posted May 19, 2021 Author ID:1458032 Share Posted May 19, 2021 Do you have a timeline on when this block will be removed? I would like to let my user know so they can run their survey with reassurance Link to post Share on other sites More sharing options...
gonzo Posted May 19, 2021 ID:1458033 Share Posted May 19, 2021 Funny you should ask. (Sorry...weird day so far). The phishing block is being removed. Please allow 2-4 hours for changes to take effect. A reputation block that would have remained has been proactively removed so that once the phishing block is lifted, you will be in good shape. Link to post Share on other sites More sharing options...
gonzo Posted May 19, 2021 ID:1458037 Share Posted May 19, 2021 I have just been told that the following phishing link is live. I need to put a block back on until your site can be verified as clean: http://survey.alchemer-ca.com/s3/50110072/Shared-Secured-Documentation-Encrypted-File Link to post Share on other sites More sharing options...
CalumJohnson Posted May 19, 2021 Author ID:1458039 Share Posted May 19, 2021 Hello, Would you mind checking again? This link and the account associated has been shut down and the data has been purged! Thank you! Link to post Share on other sites More sharing options...
thisisu Posted May 19, 2021 ID:1458060 Share Posted May 19, 2021 54 minutes ago, CalumJohnson said: Hello, Would you mind checking again? This link and the account associated has been shut down and the data has been purged! Thank you! Hi, sorry about the delay. Remaining blocks have been removed. Once a database update goes out you should no longer see the detection. Link to post Share on other sites More sharing options...
gonzo Posted May 20, 2021 ID:1458134 Share Posted May 20, 2021 Verified that block is no longer in effect. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now