This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

False Positives, Intelix Labs is using an old IP

Hi,

I am getting falser positives for https://dennisfischer.com - we ran it several times in IntelixLabs but your Tool is using an erroneous IP for the domain.

(https://intelix.sophos.com/report/9a9fe9b2df2b4b59906f52e62399e82c/static/url)

The domain is hosted on 169.100.6.5, your tool is showing/using 85.13.163.1 ?!!

We ran the WP Site through dozens of Malware Scanners and there is absolutely no malicious, is there someone who could elaborate on it ?!

Thank you in advance.

Dennis

This thread was automatically locked due to age.

Parents

0 Erick Jan 3 months ago

Hi Christoph,

Thank you for reaching out to Sophos Community. For false positive, you may refer to the following link for URL Re-assessment: https://soph.so/I0LYSa

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up -1 Vote Down

Cancel
0 Christoph Pan 3 months ago in reply to Erick Jan

Hi Erick, any update on this ??
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos 3 months ago in reply to Christoph Pan

Hello,

Can you clarify what the issue is here? Is your website being misclassified as malware, or is the IP incorrect?

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Christoph Pan 3 months ago in reply to emmosophos

1st: It is misclassified as Malware.

2nd: The IP is (also) incorrect.
Cancel
Vote Up 0 Vote Down

Cancel
0 Erick Jan 3 months ago in reply to Christoph Pan

Hi Christoph,

Thank you for the information. Can I inquire when you filed the case?

Erick Jan
Community Support Engineer | Sophos Technical Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Christoph Pan 3 months ago in reply to Erick Jan

As you could have seen by yourself, following the link: First time was at 2024-06-25T11:48:50Z
Since then we tried to reinitiate it several times unsuccessfully.
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos 3 months ago in reply to Christoph Pan

Hello,

Thank you. A Domain can not be hosted in an IP starting with 169; since that is a nonroutable IP, it is an APIPA address.

You will need to know the Public IP where your Domain is hosted, but most likely it is not a static one.

We have completed the resubmission on your behalf. If the site still shows as Malware in the next three business days, let me know.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 emmosophos 3 months ago in reply to Christoph Pan

Hello,

Thank you. A Domain can not be hosted in an IP starting with 169; since that is a nonroutable IP, it is an APIPA address.

You will need to know the Public IP where your Domain is hosted, but most likely it is not a static one.

We have completed the resubmission on your behalf. If the site still shows as Malware in the next three business days, let me know.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 PhilippRusch 3 months ago in reply to emmosophos

Today this domain has 159.100.14.179 and seems to be hosted at all-inkl.com.

If using a webinstance there, this should have permanent IP. If pointing to a local server, then who knows? Should use DDNS, then.

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Christoph Pan 3 months ago in reply to PhilippRusch

Hi, the site is hosted at a VPS at Ultahost.com and its IP is the one you mentioned. All-Inkl was the previous host which was changed a couple of weeks ago. Still no hint/idea why this was flagged as highly suspicious by Sophos.
Cancel
Vote Up 0 Vote Down

Cancel