False Positive | macdiarmidlegal.com.au

[jcfbeardsley]

What are the subjects of the false-positive (domains, URLs, or IPs)?

• macdiarmidlegal.com.au
• www.macdiarmidlegal.com.au

Why do you believe this is a false-positive?

I believe this is a false-positive because...
This website was previously compromised by a malicious actor, but the domain has since been transferred to a new registrar and connected to a different web host. A brand new (clean) website has now been built for this domain, so the address should be re-assessed.

How did you discover this false-positive(s)?

VirusTotal

Where did you find this false-positive if not listed above?

I discovered this false-positive by...
https://www.virustotal.com/gui/domain/macdiarmidlegal.com.au

Have you requested a review from other sources?

No response

Do you have a screenshot?

No response

Additional Information or Context

No response

[spirillen]

Sorry for the delay, I did see this issue, right before I entered my special comfort zone 🛌🏻

I understand the annoyance I'm going to tell you as of right now... and your gonna hate me, I'm sorry.

I do find rather resent links to the domain, and since I (Github) doesn't know you, I'm gonna request for a verification of your relation to this domain.

Also I only see that your site in under construction.

Please make the DNS check, then I'll guess @g0d33p3rsec can take over the case as I leaving for many hours.

[spirillen]

This is the single record in the db, and is insufficient to test for phishing https://macdiarmidlegal.com.au/comnet

[g0d33p3rsec]

This is the single record in the db, and is insufficient to test for phishing https://macdiarmidlegal.com.au/comnet

It looks like there was a lure targeting Commonwealth Bank hosted there in the period around January 22nd 2023
https://urlscan.io/result/f0028d61-e59c-473c-b09d-37a87ec75206/

The same URI now 404s

I have no objection to delisting if you're okay with it @spirillen

[g0d33p3rsec]

@jcfbeardsley I just rescanned www.macdiarmidlegal.com.au and we are not returning a positive result for the subdomain.

#663 should address the parent domain.