Formaloo Posted September 13 ID:1660876 Share Posted September 13 (edited) This domain (Formaloo[.]co) belongs to the Formaloo Platform (Formaloo Creative Inc., Reg code: 1000348337). Our service https://www.formaloo.com/en is a B2B SaaS that allows its users to create apps and forms. Please remove this flag from our domain and also all subdomains including ai-api.formaloo.co and others Edited September 13 by TeMerc Disabled live link(s) Link to post Share on other sites More sharing options...
Staff TeMerc Posted September 13 Staff ID:1660882 Share Posted September 13 22 minutes ago, Formaloo said: This domain (Formaloo[.]co) belongs to the Formaloo Platform (Formaloo Creative Inc., Reg code: 1000348337). Our service https://www.formaloo.com/en is a B2B SaaS that allows its users to create apps and forms. Please remove this flag from our domain and also all subdomains including ai-api.formaloo.co and others Hello- We do not show either the domain nor the IP which the domain resides on in our database, was this perhaps a Browser Guard block only? Link to post Share on other sites More sharing options...
Formaloo Posted September 13 Author ID:1660883 Share Posted September 13 Hi, Maybe, we don't know. We just received a message from one of our customers. Here's the message: I am trying to make a form, but malwarebytes says that ai-api.formaloo.co is a phishing site. Is this a legitimate site or has it been hacked? Link to post Share on other sites More sharing options...
Staff TeMerc Posted September 13 Staff ID:1660884 Share Posted September 13 4 minutes ago, Formaloo said: Hi, Maybe, we don't know. We just received a message from one of our customers. Here's the message: I am trying to make a form, but malwarebytes says that ai-api.formaloo.co is a phishing site. Is this a legitimate site or has it been hacked? As stated not blocked via the primary product, you'll need to see if it's just a Browser Guard block and if so that team will handle the issue. Link to post Share on other sites More sharing options...
Formaloo Posted September 13 Author ID:1660885 Share Posted September 13 How can we contact them or report a false positive to them? Link to post Share on other sites More sharing options...
David H. Lipman Posted September 13 ID:1660889 Share Posted September 13 It is not blocked by Malwarebytes. If you know otherwise, please provide a Malwarebytes' Product log or ScreenShot. General False Positive Reporting ListVirus Total list of False Positive Contacts Link to post Share on other sites More sharing options...
Porthos Posted September 13 ID:1660909 Share Posted September 13 2 hours ago, TeMerc said: Hello- We do not show either the domain nor the IP which the domain resides on in our database, was this perhaps a Browser Guard block only? -Website Data- Category: Phishing Domain: ai-api.formaloo.co IP Address: 172.67.215.231 Port: 443 Type: Outbound File: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 1 Link to post Share on other sites More sharing options...
Staff TeMerc Posted September 16 Staff ID:1661276 Share Posted September 16 On 9/13/2024 at 3:51 PM, Porthos said: -Website Data- Category: Phishing Domain: ai-api.formaloo.co IP Address: 172.67.215.231 Port: 443 Type: Outbound File: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Nothing shows blocked in the database . Link to post Share on other sites More sharing options...
Staff TeMerc Posted September 16 Staff ID:1661278 Share Posted September 16 27 minutes ago, TeMerc said: Nothing shows blocked in the database . Digging into this further, thanks for your patience. 1 Link to post Share on other sites More sharing options...
Staff TeMerc Posted September 16 Staff ID:1661279 Share Posted September 16 10 minutes ago, TeMerc said: Digging into this further, thanks for your patience. Ok, the following 5 subdomains are what was found in the database as currently blocked: rfkjgjedwik[.]formaloo[.]co=404 block disabled aksjhgstgayuja[.]formaloo[.]co=404, block disabled These below have active ATT phish urls and will not be unblocked serviceupdateformail[.]formaloo[.]co uwsygsh[.]formaloo[.]co wshdghfj[.]formaloo[.]co Link to post Share on other sites More sharing options...
Formaloo Posted September 16 Author ID:1661332 Share Posted September 16 Thank you, everyone, for the follow-up. 1. We found the phish URLs in these 3: serviceupdateformail[.]formaloo[.]co uwsygsh[.]formaloo[.]co wshdghfj[.]formaloo[.]co The reported page was user-generated content (UGC) in our form builder service, similar to Google forms. We deleted all forms and pages. All accounts & IP addresses are since been suspended and banned from the service. 2. Is there a way that these reports can be sent directly to us? Either to support{@}formaloo.com or to our own report abuse system: https://formaloo.net/report Can we setup something for this? This way we can ban abuse immediately 3. The issue remains on our own subdomain: ai-api.formaloo.co This is a subdomain we use ourselves and cannot be used by our users, so it should not be flagged, same goes to www. api. chatbot. ai. id. dash. Please let us know the results. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now