Why is/who listed live.barcap.com as phishing?

itguy1

January 13, 2014 14:58

This morning some of my users noticed that they couldn't get to the barcap trading platform, it seems opendns has decided this is a phishing URI.

Phishtank shows this as invalid, why is it still blocked?

2224368 https://live.barcap.com/UAB/ct_logon_basic?CT_ORIG_URL=%2FPRC%2Fservle...
added on Jan 10th 2014 8:20 PM by prebytes INVALID Offline

Not impressed with this. I think prebytes needs to meet a clue stick.

Comments

16 comments

cptkaos January 13, 2014 16:56

Still trying to get a hold of OpenDNS support staff to flush the cache. Ridiculous to say the least.

0

Comment actions Permalink
itguy1 January 13, 2014 17:02

I raised a ticket and no response from that either. God knows how one person raising a phishtank report resulted in this.

0

Comment actions Permalink
rotblitz January 13, 2014 17:06

"added on Jan 10th 2014 8:20 PM by prebytes INVALID Offline"

Beside https://www.phishtank.com/phish_detail.php?phish_id=2224368 I see also: Submitted Jan 12th 2014 11:30 AM by cleanmx for https://www.phishtank.com/phish_detail.php?phish_id=2226349

Whatever, did you open a support ticket?

0

Comment actions Permalink
rotblitz January 13, 2014 17:09

"I raised a ticket and no response from that either."

You should have received an automatic e-mail confirmation with the ticket number within minutes. See your spam folders.

Simply add barcap.com to your "never block" list for the time being. You are not locked out!

0

Comment actions Permalink
itguy1 January 13, 2014 17:29

re my ticket "This request is awaiting assignment to a support agent" so no progress for hours.

I can't white-list on my account, there is no option to allow me to do this. I suspect because i'm not a paying customer.

I had to disable the phishing protection globally on my account to work around this. I have since changed all my resolvers to Google DNS (Shudder)

0

Comment actions Permalink
cptkaos January 13, 2014 17:29

Ticket opened a while ago.

0

Comment actions Permalink
Anthony Honciano January 13, 2014 18:15

Hello all,

Thank you for your patience on this matter. We have escalated the domain to our research team for further assistance. Here's a Virus Total scan for that domain: https://www.virustotal.com/en/url/4b3c00856c74d32c3cc33c22f5575553f4369d734279b226a798881ef9ab6976/analysis/1389636733/.

We have also found your ticket and will follow up with you there as well. Please let us know if you have any other questions, and we'll be more than happy to help you.

Best regards

0

Comment actions Permalink
itguy1 January 13, 2014 18:21

Anthony,

VT shows all clean, its only you that is broken.

Thanks.

0

Comment actions Permalink
Kristy Patullo January 13, 2014 19:08

After review this site has been whitelisted, it should now be reachable.

0

Comment actions Permalink
itguy1 January 13, 2014 19:17

Kristy , Many thanks.

How did this happen?

0

Comment actions Permalink
Kristy Patullo January 13, 2014 19:21

The URL rotblitz listed was submitted to Phishtank and verified as a phish, which caused a phishing tag to live.barcap.com. After review by our Research Team the phish was either already removed or ended up being a false positive so the tag was removed.

0

Comment actions Permalink
itguy1 January 13, 2014 19:34

Why wasn't it automatically removed after peer review said it wasn't a phishing site?

0

Comment actions Permalink
Kristy Patullo January 13, 2014 19:38

Certain URLs on this domain are still flagged by sources as malicious according to Virus Total: https://www.virustotal.com/en/domain/live.barcap.com/information/, it was reviewed to make sure this site did not actually contain any phishing resources.

0

Comment actions Permalink
cptkaos January 13, 2014 19:45

Every one of those clean-mx entries are based on the original ticket that rotblitz submitted. Some extra due-diligence prior to adding a site to the block list is definitely warranted here.

0

Comment actions Permalink
cptkaos January 13, 2014 21:46

Oops I meant - prebytes not rotblitz - aplogies.

0

Comment actions Permalink
rotblitz January 13, 2014 23:33

@itguy1
"I can't white-list on my account, there is no option to allow me to do this. I suspect because i'm not a paying customer."

Nope, you have subscribed to "Premium DNS" which does not come with content filtering. In case you are a home user, open another support ticket to get your account converted to a Home Basic account - with content filtering and free.

0

Comment actions Permalink

Please sign in to leave a comment.

The OpenDNS Community has moved!

Comments