103.168.172.56 and 103.168.172.41: Website blocked due to phishing

[Vysakh]

Hello,

This is Vysakh reaching out on behalf of Fastmail, a secure private email provider. I can be reached at vysakh@fastmailteam.com.

We've received a report that a user's website hosted through us is being blocked by Malwarebytes. From our investigation, we can see that Malwarebytes is blocking the websites ending with user.fm(103.168.172.56 and 103.168.172.41). We redirect websites hosted at our domains to the format hxxp://website.user.fm, hence it's affecting all Malwarebytes users trying to access a website hosted using Fastmail.

A couple of examples of blocked websites are attached.

A test website using which you should be able to reproduce the issue is hxxp://vtest.fastmail.fm/. In this case, it was redirected to hxxp://vtest.fastmail.fm.user.fm/, and it was blocked.

I’d like to request that the block on user.fm(and the IPs 103.168.172.56 and 103.168.172.41) be cleared as soon as possible.

We at Fastmail take abuse very seriously. If this block was put in place due to abuse of your service, could you provide more details as to what you saw so that we can investigate mitigations to prevent further abuse?

I appreciate your assistance in this matter.

[BjelakovicL]

Hi,

Can you please remove these:

user.fm/files/v2-574f20c79efba896d79d44b5a7e00a9e/SarsOutstandingPayment.htm
user.fm/files/v2-ed55934b6f2a466d956cd221d328f502/ATTORNEYS%20LETTER%20.HTML
user.fm/files/v2-82e2a57c46da7c9531026b1fbab76d21/SAR.HTML

The block will be removed in the next database update.

[Vysakh]

Hi!

Thanks for getting back. 

I've removed those websites. We will also be investigating further, and where we believe an account has been used in a way that violates our Terms of Service, we will take action.