Why was my domain tagged for phishing?

[timothylindoer]

I haven't found any records in PhishTank and there's no place on the site where users can enter their credentials and yet my domain seems to be tagged for phishing.  I've also checked with other services and OpenDNS seems to be the only service that's flagged it for phishing.

Is there a way to find out why the site was flagged for phishing or have a staff member take a look at it because I'm sure there's been a mistake?

[rotblitz]

We other users cannot know.  You'll have to raise a support ticket with OpenDNS.

[timothylindoer]

Ah I see, I was hoping to find a publicly available database similar to PhishTank related to OpenDNS where I could look the domain up.

Do you know how long it takes on average to receive a reply as the domain's been tagged for about two days now?

I also just created a ticket, but right after the submission I got a 404 error ("The page you were looking for doesn't exist") and I'm also not able to see the ticket in my account.  If you have the ability to lookup the ticket then here's the URL of the page that I was redirected to after the submission: https://support.opendns.com/hc/en-us/requests/261175 (still gives a 404 on my end)

[timothylindoer]

PS

Just looked at the other posts in the forum and I think I'm experiencing the same issue as this user: https://support.opendns.com/hc/en-us/community/posts/239219068-opening-support-tickets

[rotblitz]

"Do you know how long it takes on average to receive a reply as the domain's been tagged for about two days now?"

Normally up to 72 hours during business days (Mon-Fri), sometimes longer if too many tickets are waiting.

"If you have the ability to lookup the ticket"

No, users cannot view tickets of other users.  Only staff can do this.

"I think I'm experiencing the same issue as this user"

Rather not.  I just created a ticket a minute ago, without problem (European time zone): 

[timothylindoer]

I assumed that you were a staff member considering how active you are in the community.  I just tried to create a new ticket and the same issue occurred again, but this time with a different ticket number in the URL.

By this point I should have two tickets, but there's nothing in the panel as you can see in this screenshot:

Is it also possible to call support regarding this issue or are phone calls reserved for other purposes?

[rotblitz]

No, I'm not a staff member, but a long time user.  Phone support is a paid service which you may not be subscribed to.  Try via e-mail to support[at]opendns.com.  No idea if they will accept it.

[rotblitz]

Also, I have raised a support ticket for your support ticket problem:

[rotblitz]

See https://support.opendns.com/hc/en-us/community/posts/239219068/comments/240806988

[timothylindoer]

Support got back to me and it seems as though the tickets actually are being created as I received an email notification when a staff member updated the ticket and merged my other tickets into the latest one.

If you're interested in my take on this then I think seems to be more of a permission/privilege issue and I'm guessing that the ticket isn't being assigned to my account which would explain why I'm not able to see it in the panel and also why I receive a not found message when I visit the ticket link.

I was told that a research team was looking into the domain, but do you by any chance know if they work during the weekend?  The domain's been tagged for phishing for nearly 5 days and anyone who's set OpenDNS as their DNS provider is getting a warning or an invalid redirect to a page that doesn't exist, when they visit any page on the site.  I've even had to temporarily change my own DNS just to be able to visit the site.

[rotblitz]

"seems to be more of a permission/privilege issue and I'm guessing that the ticket isn't being assigned to my account which would explain why I'm not able to see it in the panel and also why I receive a not found message when I visit the ticket link."

Yes, such an issue is most likely the case.

"do you by any chance know if they work during the weekend?"

Certainly for serious issues and important projects, but most likely not on tickets from users of their free services.

"The domain's been tagged for phishing for nearly 5 days and anyone who's set OpenDNS as their DNS provider is getting a warning or an invalid redirect to a page that doesn't exist, when they visit any page on the site."

Don't overestimate this.  Just 2% of the internet users use OpenDNS, and these can add the domain to their whitelist.

"I've even had to temporarily change my own DNS just to be able to visit the site."

No, don't do this.  You simply add an entry to your local hosts file like this:

123.45.67.89  example.com  www.example.com

[timothylindoer]

I value all visitors equally and another reason that this hit home is because I've always used OpenDNS myself and to see that phishing alert really caught me off-guard.

I also can't set a rule in the hosts file as the site uses a CDN service, but I appreciate the advice.