False Positive

[c121mark]

The domain beechwoodgolfclub.com is being blocked.  

Everything is clean on virustotal:  https://www.virustotal.com/gui/url/d03704ab6ee14c4273b1313c1b969ccfc44632c8a15d143a169259e1403985a1

It's getting flagged for:
Riskware
Riskware, or “risky software,” describes legitimate software programs that contain loopholes or vulnerabilities that can be exploited by hackers for malicious purposes.

[c121mark]

The IP this was being access from is 76.8.208.10

[thisisu]

Hello,

Thanks for reporting. It was being blocked due to this two paths:

hxxp://beechwoodgolfclub.com/wellsfargo/Wellsfargo.zip
hxxp://beechwoodgolfclub.com/wellsfargo/Wellsfargo

They still exist but they aren't loading the phish anymore. It goes to a 404 page instead. I'd recommend removing the paths entirely to reduce the chances of AV flagging the site again. In any case, I will remove the domain block.

Regards

[c121mark]

Great thank you.  The site was switched to a new platform in late February.  Could this be lingering in the cache and possibly related to the old website?  I'm not finding anything wellsfargo related in the file system. 

[thisisu]

1 hour ago, c121mark said:

Great thank you.  The site was switched to a new platform in late February.  Could this be lingering in the cache and possibly related to the old website?  I'm not finding anything wellsfargo related in the file system. 

You're welcome. Yes, that does sound probable as to what is going on.