[FALSE-POSITIVE]

[maddockj1]

Domains or links
redirect.viglink.com

More Information
How did you discover your web site or domain was listed here?
Virus Total showed you as marking our domain as phishing

Have you requested removal from other sources?
Hi I work at Sovrn on the operations team and we own the subdomain redirect.viglink.com. We are an affiliate marketing company that redirects traffic through affiliate partners with links generated by our publishers. I looked through a lot of the lists you have here and could not find what the offending link was. If you could provide me with the link I can remove any offending party or phishing redirect from our system. We have a few processes to stop malicious links including running our clicks through Google Webrisk. If we can be add to a whitelist that would be great. If not I can fix any link you provide and if you could then remove us from the list that would be great! My email is jmaddock@sovrn.com. Thanks, John

[spirillen]

Well I can find a couple uri's listed, did not test destination, but the links sure looks suspicious.

http://redirect.viglink.com/?u=https://ksharsutratherapy.com/admin/articles/thumb/.../S.F.Express%20shipping/S.F.Express%20shippings/S.F.Express%20shippings/tracking2.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=[[-Email-]]&email=3mail@b.c&key=a7e37b5f6ff1de9cb410158b1013e54a&prodOvrd=RAC&opt=false
http://redirect.viglink.com/?u=https://qrco.de/beXqxX&key=91835879f027bd9de92f72e355cd359a

[g0d33p3rsec]

Well I can find a couple uri's listed, did not test destination, but the links sure looks suspicious.

http://redirect.viglink.com/?u=https://ksharsutratherapy.com/admin/articles/thumb/.../S.F.Express%20shipping/S.F.Express%20shippings/S.F.Express%20shippings/tracking2.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=[[-Email-]]&email=3mail@b.c&key=a7e37b5f6ff1de9cb410158b1013e54a&prodOvrd=RAC&opt=false
https://urlscan.io/result/d9e0225b-1244-4fc2-9614-01fe6799cbc8/
https://urlscan.io/result/cc16888e-2b60-4eb5-af91-2b0a4cd30e51/

.weebly.com removed the malicious content, redirect.viglink.com displays a warning

https://redirect.viglink.com/?u=https://qrco.de/beXqxX&key=91835879f027bd9de92f72e355cd359a
https://urlscan.io/result/a9d3d718-0233-46c1-9690-37f9d6a73a2b/
https://urlscan.io/result/3e15549a-3843-41b9-9ed6-9a55b4582b41/

qr code disabled by qrco.de, redirect.viglink.com displays a warning

[spirillen]

.weebly.com removed the malicious content,

That is luckily something they are good at.

redirect.viglink.com displays a warning

That should return a HTTP code 410, if you ask me

So @maddockj1 nice you are caching some, and add a warning, but personally I would prefer to see the link deactivated/removed from public, while you are investigating. A fast talking phone dude, can easily make grandma click the bypass link to proceed to the phishing site.

If you are willing to make the change to my suggestions and make then return the http code 410, I will make the riles for PyFunceble special rules to match this for your sub-domain, just as I have done for heylink

[maddockj1]

@spirillen We operate the same way a warning page for Google Webrisk does. This should be more than sufficient to get a VirusTotal flag removed at this time. I can look into getting a 410 implemented but that will take some time and investigation.

[spirillen]

Hey @maddockj1 & @amit-scanova to try answer your same question as one.

First a important note for this comment, it is my thoughts, not for the collaborative team.

Why not just place domains in the whitelist systems. Well the fact is, once there, they tent to be rather sticky. and you forget to remove domains that was placed their momentarily between pleasing the victims and maintain a sound and healthy eco system.

This is not because I won't release you from the list, but there are clearly a bigger bug around the system, since a no longer existing subdomain are still listed in the PD,

@funilrys would it be possible to have your script read-in a temporary file for whitelisting, and once the script is done, truncate the file?