Website being blocked!

[connor13all]

Hi,

Our website https://joincommonwealth.xyz/ was recently flagged by some cyber security companies as malicious and we have been blacklisted on some security providers. We have recently been stress testing our services and setting up anti-bot measures with cloudfare. We think this has triggered an event somewhere.

Vodafone UK have put up an age gate restriction for our website.

We wanted to start the process of getting it removed, we believe this is a false positive.

It appears to have just started in the last week or so with some of our community bringing it to our attention.

Could we please get it removed from the blacklist? We are happy to have a call or answer any question you have, we are in the process of launching a product so it would be greatly appreciated if someone could assist us please.

@Effie 

Cheers,

[Lucy_F]

Hi @connor13all Thanks for raising this. When searching the URL in question via VirusTotal, 6 security vendors have flagged this URL as malicious. You can view these results here. Please review and take any required actions. 

Please note that once you've taken the necessary actions, it may take up to 48 hours to reflect clean certificates on VirusTotal. If users are still unable to access the URL after this, we can then look into raising a reclassification with our Network Team. 

[connor13all]

Our infrastructure with top-tier industry partners. We use Namecehap as domain registrar, AWS services for hosting and functionality, and we use several Cloudflare services for DDOS-prevention, anti-bot and form input captchas. (Cloudflare, as one of the world’s largest internet security providers, would obviously not serve up infected files or malicious sites using their services.)

We have confirmed the tests are automated as the vendors flagging us seems to change sometimes when we run the tests. For example - this morning Sophos flagged us as a risk but this afternoon we are marked as safe. You can view this for yourself here - https://www.virustotal.com/gui/url/27655389c44fe13099798d38b738ffb67dec3ade00e5a31dcb894b54b8fee823?....

We believe these false flags occurred because of a combination of moving and upgrading infrastructure, lots of load-testing, lots of emails sent, and lots of activity on all three domains and sub-domains due to the announcement last week.

The team went to extreme measures and re-uploaded all of the website static content to the CDNs - and we have reviewed all available logs and monitoring, reports, etc. There is nothing out of place.

We have appealed the flagging with all of the 9 vendors involved - and opened support tickets with Cloudflare just to be sure if it is nothing on their end. We just have to wait until their teams review the tickets / appeals.

We have verified all three domains can be verified as safe by anyone who wishes it using publicly available independent third party tools

Google (safety) -https://transparencyreport.google.com/safe-browsing/search?url=joincommonwealth.xyz&hl=en
Norton (safety) - https://safeweb.norton.com/report?url=joincommonwealth.xyz
Whois (hosting) - https://www.whois.com/whois/joincommonwealth.xyz

To add to this, we have already had the erroneous flagging with 4 more vendors cleared, other tickets have been responded too and are in the process of review.

Look forward to seeing your response.

[Lucy_F]

Thanks for getting back to us and sharing all this information with us. In order to raise a ticket to our Networking Team for a reclassification we're required for the TotalVirus results to come back clean. Any flags need to be removed for our team to accept the case. Please can you also provide a screenshot of the error page when accessing the site on our network? We'd need to provide this to our team when raising a case. Thank you. 

[connor13all]

[connor13all]

Can you please let us know if this has been cleared up now, we are down to 3/9 vendors that put false flags up.

It looks like I have no issue accessing the site now.

Here are some screenshots from vendors who have cleared us from their DB.
@Lucy_F 

[Mark]

Thanks for providing this information @connor13all. I've checked your site on a number sites and we're still being advised there's a phishing alert being advised by a number of vendors. As the screenshots provided this maybe a false reading, I've raised this to out Network team to request reclassification of your site (Ref: INC000005065759). Please be aware as the phishing alert is still present, this request maybe rejected.

[connor13all]

more and more people are taking us off their list. please pass this on to your tech team, can you please advise that we are in the process of launching the business and this is hurting us.

I cannot even access my own website to do work!

[Jason]

Thank you for your patience @connor13all. Our Network team have reviewed and reclassified the URL in question as 'Economy'. Please clear your browser cache and cookies before trying again. 

[connor13all]

Hi @Jason 

Thank you for that. So now that means all working as normal? Thanks!