Threat intelligence feeds blocking tropicalspicegarden.com

[ghost]

tropicalspicegarden.com is a legit website for a garden in Malaysia. It is found in phishing.army/download/phishing_army_blocklist.txt

[romaincointepas]

Seems to be fixed.

[ghost]

[romaincointepas]

It was not there yesterday, it made its way back. @drego85 can you check?

[drego85]

The source of this false positive is PhishTank. They report, still today, that the phishing site is active.

The domain has indeed hosted a phishing site in the past, it was probably compromised. An Example.

I ask PhishTank to review the report and report that the website is no longer phishing.

[drego85]

A further detail, VirusTotal always reports that the domain continues to be malicious.

[drego85]

PhishTank has updated the status (Submission #6072208 is currently offline)

Probably at the next generation of the list (it is created every 6h) the domain will be removed.

[drego85]

PhisTank has removed the domain, it still remains in Phishing.Database of @mitchellkrogza.

I hope it will also be eliminated from this additional source in the next few hours.

[ghost]

It's still there

[hagezi]

@drego85 It is currently blocked by Phishing.Army, which is why it ended up on my lists again.

Domain:
 - tropicalspicegarden.com OK

Malware/Phishing/Scam:
 - Malicous?       POSSIBLE (1)

 - Threat?
   HaGeZi.TIF.LT   YES
   HaGeZi.TIF      YES
   HaGeZi.TIF.RAW  YES
   Quad9           NO
   OpenDNS         NO
   ThreatFox       NO
   URLhaus         NO
   ThreatView      NO
   KADHosts        NO

 - Phishing?
   Phishing.Army   YES
   PT/OP/PH        NO
   CERT.PL         NO
   Phishing.DB     YES

Top 1M rank:
 - Umbrella:       -/-
 - Tranco:         -/-
 - Chrome:         -/-

Secure DNS:
 - CleanBrowsing   OK
 - Cloudflare      OK
 - CONTROLD.TIF    BLOCKED
 - DNS0.eu         OK
 - DNS0.eu.ZERO    OK
 - NextDNS.TIF_AI  BLOCKED
 - NRD.DGA.IDN     OK
 - OpenDNS         OK
 - Quad9           OK
 - SafeDNS         OK
 - UltraDNS        OK

Blocklists:
 - 1Hosts.Lite     OK
 - 1Hosts.Mini     OK
 - 1Hosts.Pro      OK
 - AdGuardDNS      OK
 - AhaDNS          OK
 - CONTROLD        BLOCKED
 - DNSforge.de     BLOCKED
 - EasyList        OK
 - HaGeZi.LIGHT    BLOCKED
 - HaGeZi.NORMAL   BLOCKED
 - HaGeZi.PERSONAL BLOCKED
 - HaGeZi.PRO      BLOCKED
 - HaGeZi.PRO.PLUS BLOCKED
 - HaGeZi.ULTIMATE BLOCKED
 - hBlock          BLOCKED
 - Lightswitch05   OK
 - NextDNS         OK
 - NoTracking      BLOCKED
 - OISD            OK
 - QuidsUp.NOTRACK OK
 - StevenBlack     OK

Intels:
 - Google          https://transparencyreport.google.com/safe-browsing/search?url=tropicalspicegarden.com
 - VirusTotal      https://www.virustotal.com/en/domain/tropicalspicegarden.com/information/
 - AlienVault      https://otx.alienvault.com/indicator/domain/tropicalspicegarden.com
 - Bitdefender     https://trafficlight.bitdefender.com/info/?url=https%3A%2F%2Ftropicalspicegarden.com
 - FortiGuard      https://www.fortiguard.com/webfilter?q=tropicalspicegarden.com
 - Kaspersky       https://opentip.kaspersky.com/tropicalspicegarden.com?tab=web
 - McAfee          https://siteadvisor.com/sitereport.html?url=tropicalspicegarden.com
 - Norton          https://safeweb.norton.com/report/show?url=tropicalspicegarden.com
 - OpenDNS         https://domain.opendns.com/tropicalspicegarden.com
 - URLVoid         https://www.urlvoid.com/scan/tropicalspicegarden.com/
 - Yandex          https://yandex.com/safety/?l10n=en&url=tropicalspicegarden.com

[drego85]

As anticipated, it is blocked from @mitchellkrogza's list.

@bestplayerbot, I recommend that you follow these suggestions: https://github.com/mitchellkrogza/Phishing.Database#please-remove-my-domain-from-this-list-