Receiving a malware warning on a website we own. Why and how to remove?

[tunetown]

Hello,

We started getting warnings for malware via the google chrome malwarebytes extension. The URL contains "scam" and "phishing" so I assume we are being flagged because someone has falsely reported this. The site we own is supportxxx (last three letters are the domain extension but your system is preventing me from posting if I format it correctly) and it is a legitimate site used to provide customer support. Blocking this site therefore blocks people who have legitimate customer issues, like canceling memberships, from being able to do so.

Why was the site flagged as malware, apparently starting July 4, and how do we get this removed?

Thanks

 

[Porthos]

1 minute ago, tunetown said:

but your system is preventing me from posting if I format it correctly)

Please post suspect and/or malicious URLs safely by using Code Tags.

[tunetown]

Thanks, when I try to post the URL using code tags I am also blocked for possible "spam".  The domain is in the original post, just have to know the last three letters are the domain extension. 

[Porthos]

7 minutes ago, tunetown said:

just have to know the last three letters are the domain extension. 

What are the three letters?

[tunetown]

If you read my original post, I state "The site we own is supportxxx (last three letters are the domain extension but your system is preventing me from posting if I format it correctly)". I can NOT post those three letters in the forum or I am blocked. Not sure how I can make it any clearer.

[Porthos]

6 minutes ago, tunetown said:

Not sure how I can make it any clearer.

I fully understand. I sent you a PM.

[tunetown]

Tried sending you the url via message and of course, was blocked. I'm attaching a screen capture that shows the malwarebytes warning. 

[Porthos]

5 minutes ago, tunetown said:

I'm attaching a screen capture that shows the malwarebytes warning. 

Perfect. Now wait for staff to review.

https://support.xxx/

 

Edited July 5, 2023 by Porthos

[Dashke]

Hello, tunetown,

Can you please let me know on behalf of which company you provide technical support for? Thank you very much!

[tunetown]

We provide support for Cherrypimps.com and Wildoncam.com. You will find links to our support site in the footer of those membership sites.

Thanks!

[tunetown]

We'd like to know why we started getting blocked on July 4. We've rescanned for malware and have none, we do not send any email to people from this site except to reply to tickets, and have no Phishing or other types of activities occurring. We work hard to provide an easy customer service experience because the industry does have a lot of bad actors, but we're not one of those. We try to be the opposite. 

[tunetown]

That it or is someone going to let me know why we've been flagged with a false positive?

[thisisu]

On 7/6/2023 at 8:43 AM, tunetown said:

We'd like to know why we started getting blocked on July 4. We've rescanned for malware and have none, we do not send any email to people from this site except to reply to tickets, and have no Phishing or other types of activities occurring. We work hard to provide an easy customer service experience because the industry does have a lot of bad actors, but we're not one of those. We try to be the opposite. 

If this was a phishing block as it appears from the screenshot, it was most likely due to an aggressive heuristic detection. The said detection has since been removed and I'm no longer seeing a block on your site. I'm sorry for the inconvenience. If you are still experiencing an issue with blocks, please share latest debug logs from the extension so we can look further.

[tunetown]

This has now been resolved. Thank you for the help!