Imunify's Domain Reputation list

Issue

Some website(s) got to Imunify's Reputation Management list because of Google Safe Browsing.

Environment

Any supported environment for Imunify360/ImunifyAV+.

Solution

1. Scan the accounts the reported websites belong to and make sure to clean all the infected files detected.

1. Go to Imunify360 > Malware Scanner > Users ;
2. Select the users necessary;
3. Click on the "Scan for malware" option;
4. Based on the results, choose the "Clean up all" button inside the Files tab is no automatic cleanup on detection is configured.

2.

• Wait until Google Safe Browsing updates the information about your websites. The Imunify agent updates the list once a day loading the information from certain engines but it does not happen immediately on the Google end and may take up to 24-72 hours. You can monitor the statuses of websites using their tool directly at https://transparencyreport.google.com/safe-browsing/search 
• If you are sure that your website is clean, you can submit a reconsideration request. The instructions can be found here: https://developers.google.com/web/fundamentals/security/hacked/request_review

Cause

Imunify displays a domain’s status based on external services only. Imunify does not control these blocking lists and therefore we have no possibility to manage the status of the domain being marked as dangerous and do not bear the responsibility for the domain(s) delisting from our end.

If a domain is in the Google Safe Browsing or Phishtank (or any other) blacklist, the corresponding indicator is displayed in the Reputation Management menu.

Useful links

• https://docs.imunify360.com/dashboard/#reputation-management
• https://docs.imunify360.com/command_line_interface/#check-domains
• https://transparencyreport.google.com/safe-browsing/search 
• https://developers.google.com/web/fundamentals/security/hacked/request_review

• There is also a less effective way to check a particular domain in case there is such a need to look up the status manually – you can refer to the following services:

  • https://www.spamhaus.org/lookup/ (The SBL database is updated every 10 minutes, 24/7)
  • https://mxtoolbox.com/blacklists.aspx (A tool based on over 100 DNS based email blacklists)
  • https://www.phishtank.com/ (Please note that if some URLs of the domain are listed in Phistank, the raw domain itself may be considered clean.)
  • https://transparencyreport.google.com/safe-browsing/search?hl=en (There is no certain update frequency. Google also stores statuses for domains’ URLs (especially phishing pages) rather than raw domains just like Phistank.)
  • https://www.virustotal.com/gui/home/url (This one is not always reliable, because the virustotal.com database is not updated quickly; therefore, some outdated information about the domain can be displayed there.)
  • https://www.ipvoid.com/domain-reputation-check/ (Also based on more than 40 known domain blacklists systems)