Is there an issue with the help.sfdmu.com site - Malwarebytes suddenly alerting RTP detection

forcedotcom / SFDX-Data-Move-Utility

SFDMU is a cutting-edge Salesforce data migration tool for seamless org population from other orgs or CSV files. It handles all CRUD operations on multiple related objects in one go.

BSD 3-Clause "New" or "Revised" License

444 stars 74 forks source link

Is there an issue with the help.sfdmu.com site - Malwarebytes suddenly alerting RTP detection #712

Closed veaux closed 4 months ago

veaux commented 4 months ago

Today when visting https://help.sfdmu.com Malwarebytes v 4.6.13 (latest) is blocking the site and indicating an RTP detection. Location 173.214.170.82. Event details say Malware and Compromised.

hknokh2 commented 4 months ago

Hey. It's the correct new IP. No any issues, I've moved the help center to the different webhosting: https://www.interserver.net/. It's the public web address for webhosting they offer, maybe it's become compromised somewhere. don't know. I will concider to buy a dedicated IP for the sfdmu through. I will suggest you to ask in Malwarebytes forums why it happens. It could be also a false alarm... I will ask their support what's problem too. Regards.

hknokh commented 4 months ago

This case is now considered resolved, and I am closing it for now. If you have any additional questions or concerns, please don't hesitate to reach out.

Regards.

hknokh2 commented 4 months ago

Additionally, I will let you know when will change the IP to a clean one.

veaux commented 4 months ago

Ok. I largely posted since I ended up not going to the Help site because of the warnings so thought others may as well. My Malwarebytes is just set at the defaults and it blocked me from visiting unless I overrode the suggestion...which I didn't.

hknokh2 commented 4 months ago

Ok, thx for the alert. I wrote to the hosting support and switching ip is in progress.

hknokh2 commented 4 months ago

@veaux The issue has been resolved, the ip has switched to 216.158.238.100 This IP appears as not blacklisted on any spam portals as seen here https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a216.158.238.100&run=toolpage. Please confirm that it's also passing your AV check.