False Detection website

[BobSoul]

Not sure If post here or False Positives cause both Browser Guard Plug in and Malwarebytes Web protection as of just today think the website is a phishing site or a malware site.. It is neither since its discovers home mortgage site for paying your mortgage from discover.

discoverhomeloans.mtgsvc.com

 

The other way to get to the site is which directs you to the above site. I had to turn of the protection and such just to make my monthly payment and it is the same site etc I go to each month. Called Discover and they are aware this is happening.

 

www.discover.com/HElogin

 

Edited May 25, 2021 by AdvancedSetup
disabled live hyperlink

[AdvancedSetup]

Hello @BobSoul

I've asked the Research Team to review. Here is what I've found so far though.

The site "appears" to be down at the moment.

Sucuri says they cannot scan either site. I cannot ping or trace router the site myself either.

 

 

March 27, 2021 was the last time VirusTotal scored 0 hits. It now has 4 other engines that also detect an issue on the site

 

Domain Name: mtgsvc.com
Registry Domain ID: 2093648022_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.registrar.amazon.com
Registrar URL: https://registrar.amazon.com
Updated Date: 2020-12-24T23:07:09.041Z
Creation Date: 2017-01-27T23:03:25Z
Registrar Registration Expiration Date: 2022-01-27T23:03:25Z
Registrar: Amazon Registrar, Inc.
Registrar IANA ID: 468
Registrar Abuse Contact Email: abuse@amazonaws.com
Registrar Abuse Contact Phone: +1.2067406200

 

Again, the website is not responding to a trace route at this time.

 8    47 ms    46 ms    51 ms  cr1.la2ca.ip.att.net [12.122.128.102]
  9    56 ms    47 ms    47 ms  phmaz22crs.ip.att.net [12.122.1.90]
 10    43 ms    44 ms    43 ms  12.122.108.125
 11    46 ms    47 ms    48 ms  12.116.126.230
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *        *     Request timed out.
 17     *        *        *     Request timed out.
 18     *        *        *     Request timed out.
 19     *        *        *     Request timed out.
 20     *        *        *     Request timed out.
 21     *        *        *     Request timed out.
 22     *        *        *     Request timed out.
 23     *        *        *     Request timed out.
 24     *        *        *     Request timed out.
 25     *        *        *     Request timed out.
 26     *        *        *     Request timed out.
 27     *        *        *     Request timed out.
 28     *        *        *     Request timed out.
 29     *        *        *     Request timed out.
 30     *        *        *     Request timed out.

 

 

[AdvancedSetup]

Our Browser Guard product is blocking the site. Again, I have requested our team review this but if the site is down then they will need to wait until it's back online again to recheck, unless this is a region block and the site is up from another area or region.

[BobSoul]

I can access it and it works fine if I allow in exceptions and click go to anyways ... I have used this mortgage company ( Discover card ) for years and this is recently happening. This would be the full url once the page loads

 

https://discoverhomeloans.mtgsvc.com/Account/UserLogin?conn=085{0a6e118f-71b2-4e0f-80d6-dc28680a6e60}

Once again its Discover cards Home equity loans Website. Unsure why you cannot access unless its region specific

 

 

[BobSoul]

The website is discover home loans  this the company phone  1-855-295-2193

Once I click go to it browser guard says its fine after Unless its something with there site certificate and redirect - from www.discover.com/helogin in my original I accidently had HE capitialized. It is not down for me when I access it

 

 

[AdvancedSetup]

Don't know. But it would seem to be some type of region block going on. These other scanning sites are not related to us and are simply public resources to help scan for issues and they're unable to scan the site either.

Will have to wait for our team to provide feedback. But there are 4 other antivirus sites that do say the site is hosting phishing objects.

You can add an exclusion to Malwarebytes or Browser Guard if you need to until the team replies back.

 

[BobSoul]

Thats what I did for now -- just a bit annoying and I do know its a vaild company Discover and that the loan does get paid etc from this site it may be something in there set up. I have emsisoft as well  on  another pc and it doesnt block this site. Nor does their broswer guard

[AdvancedSetup]

I hear you, but "something" is fishy.

https://www.virustotal.com/gui/ip-address/12.205.198.19/relations

Because another product does not block does not mean it's safe. It simply means they've not detected it or it's not been reported to them yet.

Our Research Team will review it and see what they can find and reply back here to you. If it truly is a FALSE POSITIVE they'll say so and remove the block.

Thank you  again

 

Edited May 26, 2021 by AdvancedSetup
updated information

[BobSoul]

Thanks -  the something fishy may be on there end like I said I use this every month and logging in everything is up to snuff etc as far as the account. I did call discover and they have said they are looking into why this is being detected. Since the address etc is the same one for years and same book mark as before etc.

 

[BobSoul]

Just noticed something that may be helpful -- It seems to be specific to chrome -- Edge doesnt block it only the chrome browser guard does --  ( I did clean out cache etc and did scans etc to make sure chrome was clean )

 

[Porthos]

5 minutes ago, BobSoul said:

Edge doesnt block it

You must not have Browser guard installed in Edge. I checked my Edge and it is blocked.

[BobSoul]

Its installed in edge and working just thought it was odd edge didnt block it Ill try again and hopefully research will find something -- 

[BobSoul]

I just wanted to add a few more pieces of info that maybe helpful to the research team  if you go to discover.com ( works fine no block) then choose home loans - home equity ( takes you here) https://www.discover.com/home-equity-loans/?sc=HC515&ICMPGN=PUB_HNAV_LOANS_DHL then select login at the top  choose my loan has been funded ( it takes you to the blocked portion of discover ) if you choose  my application is in process it takes you here https://homeloans.discover.com/accountcenter/ no block  the next link for the application process is https://dmimtg.com/UserLogin.aspx?Conn=T85{37843404-4237-4EC7-8451-0C682794D6D4} which doesnt get blocked  its only the link for logging in to my loan is funded which takes you to https://discoverhomeloans.mtgsvc.com/Account/UserLogin?conn=085{0a6e118f-71b2-4e0f-80d6-dc28680a6e60} so from what I have gathered its got to be something with there redirects and which systems they are directing you to maybe site certs or something ... I just wanted to give a detailed view of the site and how its a legit site ( discover.com and there various services).. If you go to the main page at discover.com select login login in choose home loan it takes you to this https://discoverhomeloans.mtgsvc.com/Account/UserLogin?conn=085{0a6e118f-71b2-4e0f-80d6-dc28680a6e60} and it doesnt get blocked -- so the redirects or direct linking gets blocked.

[thisisu]

Hi,

The block will be removed in the next update. Sorry for the inconvenience

Regards

[BobSoul]

Thank you - and the inconvenience was no big deal - I just don't want to see others that don't understand how this works etc to have to worry -- I use Malwarebytes exclusively at home and at all my locations at work. You guys are great :)

 

[BobSoul]

Appears to be still blocking in the last update 2.3.2 of the browser guard.. Kept in expections list for the time being

 

[Porthos]

4 minutes ago, BobSoul said:

Appears to be still blocking in the last update 2.3.2 of the browser guard.. Kept in expections list for the time being

 

discoverhomeloans.mtgsvc.com

Is blocked for me as well.

@gonzo

[gonzo]

I have just had discussions with researchers about this site.  There are active detections that they consider worrisome and feel the block may have removed erroneously.  The block is staying in effect until the website operator cleans up the site.  Sorry!