One of our clients got his website infected almost a year ago. The site indeed contained some malicious files on the FTP server, and it got marked as dangerous, with suspicion of phishing attempts.

A couple of weeks ago we finished a brand new website for this client (there is not a single file remaining from the previous website and the database is all-new as well. The site is 100% clean.

After migrating the site to the live domain, we noticed it won't show up correctly. We were getting various errors (phishing related). I checked the Google Transparency Reports and noticed the site was marked as dangerous. I requested a security-check via Google Search Console, they reviewed the site and removed it from the database. It started working well immediately (this was a couple of weeks ago).

However, after this I noticed the site still won't load on machines with third-party antivirus and antimalware software installed. For example ESET. I reported the site as false-positive at ESET, it took them quite a few days to review it but they managed to remove it from the database.

However, I noticed the same thing for many other antimalware software - e.g. Malwarebytes, AVG, etc. I contacted the support in a few cases, but no response yet.

Another problem is: It is just one step to remove the site from the database of dangerous websites - there is always a client who needs to update his database (correct me if I am wrong).

Considering there are dozens of antivirus software solutions (not all of them have good support as Google or ESET) - is there actually a working solution for this problem, better than investing hours in talking to lots of supports? Many antivirus software won't even let you ignore the phishing warning, so unless you know how to set exceptions, you won't get to the site at all. This is really a bad scenario, considering it is an eCommerce website.

  • 1. Always check the old domain against virustotal, if it is blocked, there are always hint of associated content that cause the blocking. Always do this early ASAP you take down the bad stuff. 2. Through there is no "centralise" blacklist lifting process to deal with many AV, some SEO service does provide some interface that send unblock request to many prominent AV. 3. No AV want to build API for website to automated unblock request, because it can be easily abused. – mootmoot Aug 10 at 10:19
  • Is Virustotal up to date and reliable? It shows "Phishing" next to ESET, whilst ESET already market the site clean, and it shows "Clean" next to Malwarebytes, whilst Malwarebytes won't let me access the site with up-to-date database. – Kristián Filo Aug 10 at 10:40
  • Press the rescan button of virustotal. As according to the FAQ, those scan is up to date : virustotal.com/en/faq – mootmoot Aug 10 at 11:13

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.