Reputation Still Poor for Domain but not IP 2 Months After Fix?

neil.pitman · ‎03-28-2013

The Aquaforest website (aquaforest.com) suffered an attack back in January which resulted in /en/index.asp being infected with an iFrame JavaScript Trojan.

This was corrected a few days after infection but IronPort/SenderBase still show a poor reputation whilst other measures (McAfee, AVG, Norton etc) all now report a clean site. The upshot is that unfortunately several of our customers using the Cisco IronPort Web Reputation Service cannot directly access our site for support etc so we are all are keen to resolve this issue as soon as possible.

We are not sure how to move forward at this point as we can't see any obvious cause of the Poor status - but interestingly, a Reputation lookup on our IP (217.118.136.236) gives a Neutral result as opposed to the Poor result for the domain (aquaforest.com).

We would be grateful for any ideas about what is going on here.

Thanks

Neil Pitman

Aquaforest

sfontene · ‎03-28-2013

Hello Neal we are currently reviewing this site and expect a response shortly.

Thanks,

Sylvester Fontenelle

Customer Support Engineer

Cisco Web Content Security Appliance

Cisco Technical Assistance Center RTP

United States: 1-800-553-2447

International: http://www.cisco.com/en/US/products/ps11169/serv_group_home.html

sfontene · ‎03-29-2013

After further review, it has been determined that http://www.aquaforest.com/ is affected by malware. We have taken the necessary steps to lower the WBRS score and should be reflected in the next 4-6 hours.