AnthonyS Posted April 30, 2022 ID:1513544 Share Posted April 30, 2022 Hello! I would appreciate your help as my brother-in-law's website is being blocked by Browser Guard. We receive the error "Website blocked due to phishing". The site is: nkyauto.com. It is a used car sales company. Thank you. Link to post Share on other sites More sharing options...
1PW Posted April 30, 2022 ID:1513546 Share Posted April 30, 2022 (edited) Hello @AnthonyS and While you are awaiting an authoritative reply from a Malwarebytes staffer, please consider examining the following: https://www.virustotal.com/gui/url/fd61f6729322c063e1146dfcf54e639f673f4e03ac04a6b262333200e92d8dfc https://securityscan.getastra.com/malware-scanner?site=https%3A%2F%2Fnkyauto.com https://sitecheck.sucuri.net/results/nkyauto.com https://observatory.mozilla.org/analyze/nkyauto.com HTH Edited April 30, 2022 by 1PW Link to post Share on other sites More sharing options...
AnthonyS Posted April 30, 2022 Author ID:1513547 Share Posted April 30, 2022 11 minutes ago, 1PW said: Hello @AnthonyS and While you are awaiting an authoritative reply from a Malwarebytes staffer, please consider examining the following: https://www.virustotal.com/gui/url/fd61f6729322c063e1146dfcf54e639f673f4e03ac04a6b262333200e92d8dfc https://sitecheck.sucuri.net/results/nkyauto.com Thank you. That's interesting information but I sadly do not know what it means or how that helps me to figure out why the website is blacklisted. Seems to state that some URLs were not accessible? That makes no sense. Link to post Share on other sites More sharing options...
Staff BjelakovicL Posted April 30, 2022 Staff ID:1513550 Share Posted April 30, 2022 Hi, Seeing many reported links, for example: https://nkyauto.com/new https://metamask-finance-online.nkyauto.com/pan/metamask https://www.nkyauto.com/metamask-finance-online/pan/metamask/ Link to post Share on other sites More sharing options...
1PW Posted April 30, 2022 ID:1513551 Share Posted April 30, 2022 (edited) Hello @AnthonyS: Note: You are still waiting for an official reply from a Malwarebytes staffer. Unfortunately the technical depth of the various analysis reports are seldom written for the layperson/Internet user. Suffice to say the above edited reports likely should be forwarded to your brother-in-law's professional website maintenance team for action. HTH Edited April 30, 2022 by 1PW Link to post Share on other sites More sharing options...
AnthonyS Posted April 30, 2022 Author ID:1513553 Share Posted April 30, 2022 3 minutes ago, 1PW said: Hello @AnthonyS: Note: You are still waiting for an official reply from a Malwarebytes staffer. Unfortunately the technical depth of the various analysis reports are seldom written for the layperson/Internet user. Suffice to say the above edited reports likely should be forwarded to your brother-in-law's professional website maintenance team for action. HTH Well, unfortunately he has asked his technical support team for help, but they're unable to figure it out. I did try to visit some of the webpages listed in the PhishTank website and see that they have something to do with crypto wallets - and he has nothing on his website dealing with crypto wallets or digital currency. Could someone be using his site to do something malicious?? Link to post Share on other sites More sharing options...
AnthonyS Posted April 30, 2022 Author ID:1513554 Share Posted April 30, 2022 12 minutes ago, BjelakovicL said: Hi, Seeing many reported links, for example: https://nkyauto.com/new https://metamask-finance-online.nkyauto.com/pan/metamask https://www.nkyauto.com/metamask-finance-online/pan/metamask/ What could this mean? I am not able to see the HTML code for the /new page and do not understand why it is redirecting to the DHL site [in German]!?!? Also, what the heck is "MetaMask"?? Link to post Share on other sites More sharing options...
David H. Lipman Posted April 30, 2022 ID:1513558 Share Posted April 30, 2022 It means nkyauto.com is being used in a malicious fashion. In the cases presented, Phishing. Link to post Share on other sites More sharing options...
AnthonyS Posted April 30, 2022 Author ID:1513562 Share Posted April 30, 2022 15 minutes ago, David H. Lipman said: It means nkyauto.com is being used in a malicious fashion. In the cases presented, Phishing. That's helpful Dave; however, I'd love to know specifically what the issue is - what is the phishing campaign being used and how. Can you provide any details? Thank you. Link to post Share on other sites More sharing options...
David H. Lipman Posted April 30, 2022 ID:1513563 Share Posted April 30, 2022 Is nkyauto.com your web site ? Link to post Share on other sites More sharing options...
AnthonyS Posted April 30, 2022 Author ID:1513565 Share Posted April 30, 2022 It is my brother-in-law's. Matthew Ryan. 27 minutes ago, David H. Lipman said: Is nkyauto.com your web site ? Dave; however, I'd love to know specifically what the issue is - what is the phishing campaign being used and how. Can you provide any details? Thank you. Link to post Share on other sites More sharing options...
David H. Lipman Posted April 30, 2022 ID:1513569 Share Posted April 30, 2022 It's a moot point. This 11+ year old site has been compromised and Mr. Ryan will have to take steps with his hosting company to mitigate the situation at-hand. Link to post Share on other sites More sharing options...
Porthos Posted April 30, 2022 ID:1513570 Share Posted April 30, 2022 39 minutes ago, AnthonyS said: It is my brother-in-law's I think he should contact the web host get them to clean it up. If the web host cant seem to get it done or say nothing is wrong, he needs to hire a pro company to do it. An example is https://sucuri.net/ Link to post Share on other sites More sharing options...
Porthos Posted April 30, 2022 ID:1513571 Share Posted April 30, 2022 (edited) Here is an example. Not the only issue on the site. Submitted URL: https://nkyauto.com/newEffective URL: https://lorneparkplace.ca/vendor/usps/usps/verification/ Shows the following https://www.virustotal.com/gui/url/e3f261e849d988fc46700554976bc57cd024626ff65aedbd9ca74ecbc75530a2?nocache=1 Edited April 30, 2022 by Porthos Link to post Share on other sites More sharing options...
AnthonyS Posted May 7, 2022 Author ID:1514559 Share Posted May 7, 2022 Thank you Porthos and everyone. This has been very helpful. Brother-in-law is working with a specialist to get it cleaned up. Link to post Share on other sites More sharing options...
David H. Lipman Posted May 7, 2022 ID:1514562 Share Posted May 7, 2022 Great! Thanx for the update. After Mr. Ryan and the Hosting company with the assistance of a specialist get the site remediated, please start a NEW request to have the site unblocked. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now