23

I have a website which is basically a service platform. As far as I know there is no malware in my website (at least not found according to these free scanners). However, Check Point malware database definition is blocking requests to my website because it is somehow detecting a malware, whose details is something like this:

Connection to IP associated by DNS trap with malicious domain. See sk74060 for more information.

Screenshot:

enter image description here

As far as I understand, my website is being detected falsely (a false positive). How do I circumvent this?

Improve this question
0

2 Answers 2

Reset to default
48

Your website www.sheba.xyz is hosted on a shared system together with lots of others. This means that all use the same IP address, 166.62.28.88. Unfortunately, not all of the sites on this IP address play nice, which means that this IP address got reported as a cause of trouble.

Unfortunately it is not only Checkpoint which reports this site as bad, but several others too; see report from cymon. There in the timeline you can also see why the IP address got put on the blacklists; namely because it was used as a target of phishing and a distribution point for malware on several domains hosted at this IP address.

Which means that the best way to deal with the problem is to talk to your hosting provider so that the bad sites get removed. If this does not help, change your hosting provider to one which cares more (and maybe costs more).

Improve this answer
7
  • 3
    @jpmc26 I don't sell anything. :)
    – Mark Buffalo
    Apr 29, 2016 at 1:23
  • 6
    The idea that shared hosting is cheap has not been true for years. Nowadays VPS and even partially-physically-separate, VPS-like hosting is generally much cheaper than shared hosting, because the only hosts who are doing shared hosting have not updated their business models in the past decade. You can get a VPS (real Xen or KVM, not OpenVZ) capable of hosting any site that could get by with shared hosting for well under $10/mo, maybe as low as $2-3.
    – R.. GitHub STOP HELPING ICE
    Apr 29, 2016 at 2:47
  • 4
    Do you have any examples of VPS subsctiptions in the $2-3 range or anything along those lines?
    – EChan42
    Apr 29, 2016 at 6:54
  • 2
    @EChan42 Digital Ocean is a well known example. Their entry level package is $5 per month, and should be fine for a low/moderate traffic site which doesn't have a CPU intensive backend (and in any case, should excel compared to a shared hosting package where the resources are typically very thinly spread). You can even pay by the hour, which is useful for the testing phase when you don't need 24/7 availability.
    – Jon Bentley
    Apr 29, 2016 at 9:48
  • 2
    @EChan42: there are quite a few companies out there that offer small VMs for a few $/month (or really small ones for $10/year). Of course they share some of the problems of cheap shared hosting: they can be overcrowded so you'll see a lot of I/O contention, and for that price don't expect great support. Also you'll be managing the server yourself so will need more knowledge. This isn't the right place to be discussing specific hosts but you'll find plenty advertised/discussed on sites like lowendtalk.com/lowendbox.com
    – David Spillett
    Apr 29, 2016 at 10:26
10

As far as I know, you don't "circumvent" the false positives, you have to contact Check Point and let them know who you are and work with them to get the false positive fixed, maybe they know something you don't, or you know something they don't.

Improve this answer
2
  • 2
    @MD Searching their site shows several support calls about this issue, but since I do not have an account with them I cannot give you more detailed info.
    – user13695
    Apr 28, 2016 at 14:48
  • @JanDoggen: Thank you very much! I will take a look.
    – MD Sayem Ahmed
    Apr 28, 2016 at 14:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .