School District website blocked

GirlGavel

I can't figure out why the Centennial School District in Portland, OR (csd28j.org) is blocked because "it has been reported as harmful."  Does any human mind review the "reports" and think about the "harm?"

Ukko

Hello,

 

You able to transfer this URL to F-Secure SAS:

https://www.f-secure.com/en/web/labs_global/submit-a-sample#sample-url

 

You able to check option "I want to give more details about this sample and to be notified of the analysis results" and related categories (like harmless page blocked by browsing protection); There should be response from F-Secure Labs and re-rating/re-analyzing URL; Usually it can be some days (or three-four work days) - but maybe critical (as harmful false positive) can be much speedy;

 

They should re-rate it (accordingly to safe rating) or explain why it harmful-rated;

 

Also sorry for my worst English.

========

 

As my suggestion about potential reasons:

-> when I searched URL (csd28j.org) - except related results there also some other pages probably with meanings that Centennial School District in Portland website using Wordpress theme; If yes - maybe there was automatically detected something as exploiting (or try to do so) vulnerable places of wordpress theme / template (it can be open redirects or cross-site scripting) and it start be under blocklist;

 

And general words "it has been reported as harmful" under F-Secure blockpage not always about "such meanings". It should be more like "in somewhat reasons page start be rated as harmful" (it can be reported and analyzing - usually there should not be false positive; can be automatically by detecting - which most likely can be with false positives; can be such information from known blocklist/harmful-websites lists - which F-Secure also able to use for their databases);

 

Sorry for my reply.

 

Thanks.

 

// later added:

 

As example, based on virustotal view:

https://www.virustotal.com/ip-address/72.10.52.78/information/

 

There was detection (at least by third companies - mostly large known companies) for certain URLs under their domain (generally?! subdomains or part of their website);

 

And, as example, some of them still marked as malicious website (today) :

https://www.virustotal.com/url/13069d405d3fdbeaf216db38ca4ea58d7f2e0494f13c9ddc7a0136da22db05d2/analysis/1495739339/

 

But with one less company under list; But virustotal do not show all of potential 'detected' (marked) as harmful resources; So maybe there was another triggers or some activities; And maybe on current time it not valid (or was false positive from first);