ShareVision Posted September 19 ID:1662003 Share Posted September 19 Hi There, We are ShareVision, a SaaS app provider that services human services organizations primarily in Canada. Part of what our app does is provide the ability to send email alerts to users about important things that are logged in the app. We use the SendGrid service to send 10s of thousands of emails per day. On Tuesday, a bad actor managed to hack one of our API keys and start sending phishing messages as us. We in conjunction with SendGrid shut down our email and switched out the API key and we are now back up and running and the messages are no longer being sent. Unfortunately this has caused your app to block our domain and flag it as a phishing risk as well as reporting that there is an issue with our SSL certificate. Nothing has changed with our certificate and it is completely valid. Based on the fact that we have mitigated the issue we would like to know what we need to do to get unblocked by your app. Thanks Link to post Share on other sites More sharing options...
Porthos Posted September 19 ID:1662030 Share Posted September 19 @ShareVision We need to know the exact blocked URLs. Link to post Share on other sites More sharing options...
ShareVision Posted September 19 Author ID:1662037 Share Posted September 19 (edited) All of our sites have a different subdomain. One customer that reported the issue is at https://cscl2.sharevision.ca They said any attempt to connect to any url at that domain was blocked with this message: We have other customers report the issue as well. Do you need all subdomains? (There are hundreds). Edited September 20 by TeMerc Disabled live link(s) 1 Link to post Share on other sites More sharing options...
Porthos Posted September 19 ID:1662038 Share Posted September 19 Just now, ShareVision said: We have other customers report the issue as well. Do you need all subdomains? (There are hundreds). Let's let the staff decide about additional info. Link to post Share on other sites More sharing options...
ShareVision Posted September 19 Author ID:1662040 Share Posted September 19 OK thank you for looking into it. Can you elaborate on the process and potential timeline? Link to post Share on other sites More sharing options...
Porthos Posted September 19 ID:1662043 Share Posted September 19 7 minutes ago, ShareVision said: OK thank you for looking into it. I am not looking into anything. I just noticed you gave no info for the staff to act on. 8 minutes ago, ShareVision said: Can you elaborate on the process and potential timeline? Usually within 12-24 hours. Usually sooner. Link to post Share on other sites More sharing options...
ShareVision Posted September 20 Author ID:1662193 Share Posted September 20 Checking in on this request. I was just talking with a customer that is using the cloud version of your software and they are not able to whitelist our domain which means that they can't access their system without turning off your software. That does seem to be in anybody's best interest. Can anyone at Malwarebytes let us know where we are at with this so I can pass it on to my customers? Thanks in advance Link to post Share on other sites More sharing options...
Porthos Posted September 20 ID:1662277 Share Posted September 20 I will alert staff since it seems to have been overlooked. @TeMerc Link to post Share on other sites More sharing options...
Staff TeMerc Posted September 20 Staff ID:1662291 Share Posted September 20 On 9/19/2024 at 11:57 AM, ShareVision said: All of our sites have a different subdomain. One customer that reported the issue is at https://cscl2.sharevision.ca They said any attempt to connect to any url at that domain was blocked with this message: We have other customers report the issue as well. Do you need all subdomains? (There are hundreds). Hello-Multiple freshly detected urls the last day or so: VirusTotal - Domain - url2866.sharevision.ca Link to post Share on other sites More sharing options...
ShareVision Posted September 20 Author ID:1662306 Share Posted September 20 Hi and thanks for responding. These urls are generated by Gmail when a person clicks on a link in an email. My understanding is that the url is based on the sender's domain which in this case was one of ours. We have worked extensively with SendGrid who is our email provider and they have confirmed that no more phishing messages with this link have been sent since the 17th. These detections are just people who received the message finally getting around to clicking the link in the messages that were sent. We do not have a subdomain "url2866", this is autogenerated by the gmail application when a user clicks on a link in gmail that was sent by us. What do you suggest that we do in this situation? Is there anyway you can restrict the blacklist to just that subdomain so our customers get back to work? Link to post Share on other sites More sharing options...
ShareVision Posted September 20 Author ID:1662335 Share Posted September 20 Apologies, I now realize that these urls are created by the SendGrid click tracking service. In either case, the emails have already been sent and there is nothing we can do about people clicking on them at this point. We are very much open to suggestions as to how to rectify the situation. Thanks for any insight you can provide. Link to post Share on other sites More sharing options...
ShareVision Posted September 24 Author ID:1663086 Share Posted September 24 Any updates on this? We were finally able to have the subdomain where the issue were shut down as of Saturday. Link to post Share on other sites More sharing options...
ShareVision Posted September 25 Author ID:1663280 Share Posted September 25 Hi Again, We are still having many issues reported where the blocking of our entire domain is preventing users from accessing our application. As mentioned previously, the subdomain "url2866" was removed on Saturday. Can I please have an update on why we are still being blocked? Link to post Share on other sites More sharing options...
Porthos Posted September 25 ID:1663281 Share Posted September 25 @TeMerc Link to post Share on other sites More sharing options...
Staff TeMerc Posted September 25 Staff ID:1663283 Share Posted September 25 17 minutes ago, ShareVision said: Hi Again, We are still having many issues reported where the blocking of our entire domain is preventing users from accessing our application. As mentioned previously, the subdomain "url2866" was removed on Saturday. Can I please have an update on why we are still being blocked? Thanks for the updated info, VT still showing some detected urls as live but for the most part they appear 404 and their latency is kind of slow so we've unblocked the sub domain, thanks for your patience. Link to post Share on other sites More sharing options...
Recommended Posts