Dangerous URL

[it.papdan]

Hi,

Kaspersky Web Anti-virus is flagging the  URL 

“https://emailsense.online/et/c3.php?tr=2021081217074399er8kj8hks8kxbgg__aHR0cHM6Ly9tYXJjdXN0b2RheS5jb20uYXUvbWVtYmVyL3dlYnBhZ2VzLzgwX3ZpZXctcmVwb3J0LnBocD9ndWlkPTdiZjhlM2JlYTVjMzgwZmZjNTMyZDU4Mzk1Mzc1MDFjJmFtcDtwaWQ9Kg”

 

as “Dangerous” [Potential dangerous link disabled]

The link is not phising or malware and we manage this domain.
Please re-analyze!
Thanks.

Regards,

Ikhwan

[harlan4096]

Welcome to Kaspersky Community.

 

Weird 🤔:

 

https://opentip.kaspersky.com/https%3A%2F%2Femailsense.online%2Fet%2Fc3.php%3Ftr%3D2021081217074399er8kj8hks8kxbgg__aHR0cHM6Ly9tYXJjdXN0b2RheS5jb20uYXUvbWVtYmVyL3dlYnBhZ2VzLzgwX3ZpZXctcmVwb3J0LnBocD9ndWlkPTdiZjhlM2JlYTVjMzgwZmZjNTMyZDU4Mzk1Mzc1MDFjJmFtcDtwaWQ9K/

 

https://www.virustotal.com/gui/url/2527143acc13426c2b15955ba0cef1b515fa400df0631a7102acbe886c6b1e2b/detection

 

I’ve sent to K. analyst via KOTIP service to get a final verdict...

[it.papdan]

ah sorry,

here the right
https://emailsense.org/et/c3.php?tr=2021081217074399er8kj8hks8kxbgg__aHR0cHM6Ly9tYXJjdXN0b2RheS5jb20uYXUvbWVtYmVyL3dlYnBhZ2VzLzgwX3ZpZXctcmVwb3J0LnBocD9ndWlkPTdiZjhlM2JlYTVjMzgwZmZjNTMyZDU4Mzk1Mzc1MDFjJmFtcDtwaWQ9Kg

the default was emailsense.org, yesterday i’ve tried to change emailsense.online, but this change makes a mess for our mail server

[harlan4096]

Can You post a screenshot of the detection, thanks

[it.papdan]

 

and
 

 

[Flood and Flood's wife]

Hello @it.papdan &  @harlan4096, 

Also: 

May we ask, is that emailsense URL meant to resolve to marcustoday? 

 

Thank you🙏

Flood🐳+🐋

[harlan4096]

I got a final verdict from analyst:

 

 

I resent to that analyst the link of this thread…

[it.papdan]

Hi…
yes this code link is refer to marcustoday website, marcustoday.com.au is our clients

[harlan4096]

Waiting verdict from K.  Anti-Phising group...

[harlan4096]

 

[it.papdan]

Hi,
When the link will be not flagged as phising?

Thank you

[it.papdan]

Hi Harlan4096,

Could you describe to me when it was first flagged as a false positive "phishing link" on kaspersky database?

Thank you

[harlan4096]

It should be excluded in a few hours after the verdict, update manually signature to check.

 

And no, I can’t say when was 1st flagged...