Getting RiskWare block on https://www.listingspark.com while using Chrome

[cullman]

Thank you.  I know the owners of the site, it's a valid site that shouldn't have any malware on it.

 

Thanks,

 

Cayce

[TeMerc]

5 minutes ago, cullman said:

Thank you.  I know the owners of the site, it's a valid site that shouldn't have any malware on it.

 

Thanks,

 

Cayce

Hello- the issue at hand is this file:

http://listingspark.com/wp-includes/js/jquery/jquery.min.js

Detection: VirusTotal - File - 5d7cf82c64f0a700a0635bdd012facb9415f02edbcea01aa8ec9ac3c654965db

[cullman]

My apologies for the follow up question, especially if this is the wrong forum.  I download the jquery.min.js from the site and I run it through virus total and it tells me my Jquery is fine. Also, when I curl and hash my JQuery I get a different sha256 than you seem to.  If I put listingspark.com the url into VirusTotal the only thing I see is that fortinet flags the site.  How did JQuery come to your attention?  TIA.

curl http://listingspark.com/wp-includes/js/jquery/jquery.min.js | sha256sum
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 162 100 162 0 0 915 0 --:--:-- --:--:-- --:--:-- 910
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a -

 

[thisisu]

6 hours ago, cullman said:

My apologies for the follow up question, especially if this is the wrong forum.  I download the jquery.min.js from the site and I run it through virus total and it tells me my Jquery is fine. Also, when I curl and hash my JQuery I get a different sha256 than you seem to.  If I put listingspark.com the url into VirusTotal the only thing I see is that fortinet flags the site.  How did JQuery come to your attention?  TIA.

 

curl http://listingspark.com/wp-includes/js/jquery/jquery.min.js | sha256sum
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 162 100 162 0 0 915 0 --:--:-- --:--:-- --:--:-- 910
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a -

 

 

Thanks for the detail. I'm going to unblock the domain now. It looks like it was last hosting the malicious jquery.min.js on 10.25.2021. You're right, it's clean now

The unblock will occur in the next database update.

Regards

[cullman]

Excellent, thank you’!  Do you mind checking app.listingspark.com as well?  It too seems to be blocked. Or if *.listingspark.com can be reevaluated that would be ideal.

[thisisu]

7 hours ago, cullman said:

Excellent, thank you’!  Do you mind checking app.listingspark.com as well?  It too seems to be blocked. Or if *.listingspark.com can be reevaluated that would be ideal.

It's unblocked now. I unblocked *.listingspark.com at the same time of when I posted earlier.