Skip to main content

⚠️ Please note that this topic or post has been archived. The information contained here may no longer be accurate or up-to-date. ⚠️

C1 dmg download site blocked - "malware"

ondebanks
Hi,

I have repreatedly tried upgrading C1 from 7.1 to 7.1.3, hosted on my workplace Mac. As soon as I click the 7.1.3 dmg download link, I get an error page:

--------------------

This Page Cannot Be Displayed

Based on the University's access policies, this web site ( http://80.237.159.100/973c51bf-de0b-4c1 ... v7.1.3.dmg ) has been blocked because it has been determined by Web Reputation Filters to be a security threat to your computer or the corporate network. This web site has been associated with malware/spyware.

Threat Type: othermalware
Threat Reason: Domain reported and verified as serving malware. HTTP request directly to an IP address.

If you have questions, please contact ISS Service Desk ( servicedesk@nuigalway.ie ) and provide the codes shown below.
Notification codes: (1, MALWARE, othermalware, Domain reported and verified as serving malware. HTTP request directly to an IP address., BLOCK-MALWARE, 0x05dc36b9, 1378890517.744, QAAAAQAAAAAAAAAAGv8ACP8AAAD/AAAAAAAAAAAAAAE=, http://80.237.159.100/973c51bf-de0b-4c1 ... v7.1.3.dmg)

-----------------

Was Phase One aware that their premier software serving site is (presumably wrongly!) being associated with malware threats?

Something must have changed recently, as I never had a problem downloading C1 previously to the same machine on the same network.

Hopefully this is a glitch which can be fixed on the Phase One side.

Ray
0

Comments

9 comments

Date Votes
  • sizzlingbadger
    Its a problem with the malware detection at your workplace its not Phase One problem.
    0
  • Paul Steunebrink
    [quote="ondebanks" wrote:
    If you have questions, please contact ISS Service Desk ( servicedesk@nuigalway.ie ) and provide the codes shown below.
    Notification codes: (1, MALWARE, othermalware, Domain reported and verified as serving malware. HTTP request directly to an IP address., BLOCK-MALWARE, 0x05dc36b9, 1378890517.744, QAAAAQAAAAAAAAAAGv8ACP8AAAD/AAAAAAAAAAAAAAE=, http://80.237.159.100/973c51bf-de0b-4c1 ... v7.1.3.dmg)

    Instructions are in the message: contact your universities service desk.
    0
  • ondebanks
    [quote="Paul_Steunebrink" wrote:
    [quote="ondebanks" wrote:
    If you have questions, please contact ISS Service Desk ( servicedesk@nuigalway.ie ) and provide the codes shown below.
    Notification codes: (1, MALWARE, othermalware, Domain reported and verified as serving malware. HTTP request directly to an IP address., BLOCK-MALWARE, 0x05dc36b9, 1378890517.744, QAAAAQAAAAAAAAAAGv8ACP8AAAD/AAAAAAAAAAAAAAE=, http://80.237.159.100/973c51bf-de0b-4c1 ... v7.1.3.dmg)

    Instructions are in the message: contact your universities service desk.


    I've done that, and I await their reply to my support case - but I suspect that they will bounce responsibility back to Phase One. "HTTP request directly to an IP address" is probably the thing that triggered the over-zealous block - perhaps that is bad web server practice on P1's part?
    0
  • Drew Altdo
    [quote="ondebanks" wrote:
    ...perhaps that is bad web server practice on P1's part?


    We use the easiest, simplest and most direct communication for downloading and activating software. We have customers all over the planet, some in locations that REQUIRE this type of communication. We try to serve the vast majority of customers in the simplest manner.
    If you're university won't allow for a direct HTTP download you can create a support case and we can get you a download through something more complex, like Drobox or Yousendit.
    0
  • ondebanks
    OK, great, thanks Drew. I'll see what response I get here first. Could take some time as they're probably swamped with support requests from new students who've just started.
    0
  • Drew Altdo
    [quote="ondebanks" wrote:
    ... Could take some time as they're probably swamped with support requests from new students who've just started.


    In the meantime, why not create a support case and we can help you explore some alternatives.
    0
  • ondebanks
    Well, this is what our support techs said:

    --------------------------------------------

    On 13/09/2013, at 16:34, Owens, Ron wrote:
    Ray,
    I can ask Cisco to re-evaluate their Web Reputation score. Unfortunatey I am away for the next 2 weeks so won't be able to do it till then.

    If you visit http://www.senderbase.org, it will give you the ability to see why the site has a poor reputation.

    Ron

    -----

    So I did that: I put the C1 Pro server IP address into senderbase.org, and got this:

    http://www.senderbase.org/lookup?search ... 37.159.100

    ..."Fwd/Rev DNS Match: No"
    ..."Email Reputation: Neutral"...
    ..."Web Reputation: Poor"...

    If you drill down through the detailed listings below the top summary, the bad rep seems to come from occasional failures in the Fwd/Rev DNS Match category.


    So that pretty much absolves "my end" from culpability - there seems to be a genuine issue with your server, and it's being caught by Cisco.

    Ray
    0
  • ondebanks
    [quote="Drew" wrote:
    [quote="ondebanks" wrote:
    ... Could take some time as they're probably swamped with support requests from new students who've just started.


    In the meantime, why not create a support case and we can help you explore some alternatives.


    Thanks Drew. Quickest solution of all - could you just post a Dropbox link to the dmg file here?

    Ray
    0
  • Drew Altdo
    [quote="ondebanks" wrote:
    [quote="Drew" wrote:
    ...could you just post a Dropbox link to the dmg file here?

    Ray


    No, I cannot.
    Please create a support case and we will get you a direct download via the case.
    0

Post is closed for comments.