False Positive | alejandrasalas.com

[Cerbeross]

What are the subjects of the false-positive (domains, URLs, or IPs)?

• alejandrasalas.com
• https://alejandrasalas.com
• 198.178.122.146

Why do you believe this is a false-positive?

I request reconsideration for www.alejandrasalas.com, currently marked as potentially dangerous on your systems.

I have performed the following actions:

1. Full server scan removing all malicious code
2. Update of all systems, CMS and plugins
3. Implementation of SSL and additional security measures
4. Verification of absence of phishing content

My site now meets the necessary security standards. I kindly request that you reconsider the current classification.

I understand the importance of a safe internet and appreciate your work. I am available to provide additional information or perform any action necessary to verify the security of my site.

Thank you for your attention.

How did you discover this false-positive(s)?

Other (Please fill out the next box)

Where did you find this false-positive if not listed above?

I discovered it by scanning this website: https://www.apivoid.com/tools/url-reputation-check/
Additionally, when I have internet from the Netlife provider (Ecuador), it does not let me access the page. This provider has an antivirus from VirusTotal, I believe.

Have you requested a review from other sources?

Yes, in norton

Do you have a screenshot?

Screenshot

Additional Information or Context

No response

[phishing-database-bot]

Verification Required

@Cerbeross, thank you for submitting a false positive report! To help us verify your ownership of the affected domain(s), please complete the following steps:

1. Set a DNS TXT record for the domain(s) listed in this issue with the following details:

   • Record Name: _phishingdb
   • Record Value: antiphish-934a7af4a18f16950acc5ef5e9bc190706b70427

   Your Verification ID: antiphish-934a7af4a18f16950acc5ef5e9bc190706b70427

2. Wait for DNS propagation (this may take a few minutes to a few hours).

3. Reply to this issue once the TXT record has been set.

Important Notes

• Verification does not guarantee whitelisting. The Phishing.Database team will review your report after verifying ownership, but the decision to whitelist depends on further investigation and analysis.
• If the record cannot be set or you need alternative methods of verification, please contact us at contact@phish.co.za - preferably from the domain's official email address.

How to Check the TXT Record ?

You can verify that the TXT record is properly set using:

• Online tools like MXToolBox TXT Lookup.
• The command line:

  dig TXT _phishingdb.example.com
  

Thank you for your cooperation! We will address your issue as soon as possible after verification.

The Phishing.Database Project Team.

[Cerbeross]

Good morning, the requested TXT record has been added.

[spirillen]

Comments

DNS Check

ptcheck alejandrasalas.com antiphish-934a7af4a18f16950acc5ef5e9bc190706b70427
The test value matches the DNS TXT record.

Thanks for using my tools.
Please consider a sponsor ship at https://www.mypdns.org/donate

Known phishingrecords

What can you tell me about these records, known to us from the PD project?

Subject                                                                                              Status      Source     Expiration Date   HTTP Code  Checker       Tested At          
---------------------------------------------------------------------------------------------------- ----------- ---------- ----------------- ---------- ------------- -------------------
https://alejandrasalas.com/wp-admin/china/SFEpress/New/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= ACTIVE      HTTP CODE  Unknown           301        AVAILABILITY  08. Mar 2025 03:30:10

Execution Time: 00:00:00:3.02652

Verdict

I don't like http code 301 on a phishing script that was served from within wp-admin...

HTTP response status codes 410 Gone

The guidelines outlined in RFC 7231, specifically section 6.5.9, are quite explicit: the appropriate status code to use for links that will not be restored is 410 Gone. In contrast, a 404 status code indicates that the resource is temporarily unavailable.

The 410 (Gone) status code indicates that access to the target resource is no longer available at the origin server and that this condition is likely to be permanent. If the origin server does not

know, or has no facility to determine, whether or not the condition is permanent, the status code 404 (Not Found) ought to be used instead.

The 410 response is primarily intended to assist the task of web maintenance by notifying the recipient that the resource is intentionally unavailable and that the server owners desire that remote links to that resource be removed. Such an event is common for limited-time, promotional services and for resources belonging to individuals no longer associated with the origin server's site.
It is not necessary to mark all permanently unavailable resources as "gone" or to keep the mark for any length of time -- that is left to the discretion of the server owner.

A 410 response is cacheable by default; i.e., unless otherwise indicated by the method definition or explicit cache controls

---

Thank you for reaching out. I want to clarify that I am not the owner of this project nor user of it. I assist with the whitelisting of domains to the best of my ability, but I do this as an unpaid volunteer in my free time. Your understanding and patience are greatly appreciated.
Additionally, I would like to share that I occasionally struggle with a mild degree of PTSD, which means I tend to forget even small details, like did I have breakfast this morning. So please bare with me, if I'm loosing the thread sometimes. Your understanding and patience in this matter are greatly appreciated.

If you feel inclined to buy me a cup of coffee, it would certainly help speed up the process, but please know that it will not influence my decisions or verdicts in any way.

Additionally, I want to be very clear: I do not access any Cloudflare, CloudFront, or Google networks. This is a matter of principle for me, as I believe in upholding human rights, the right to online privacy, and network security. These services often intercept traffic to collect personally identifiable information (PII), which I believe compromises our autonomy and makes us all puppets to the big tech puppeteers.

Thank you for your understanding!

Best regards.

[Cerbeross]

Dear Sir,

Thank you for your response and the time you spent reviewing our case. I would like to inform you that we have taken the following measures on the website:

The site is now free of any potential threats or malicious code. We confirm that it is virus-free and safe for use.

The URL in question now returns a 410 (Gone) HTTP code instead of 404, in accordance with recommended best practices.
We appreciate your voluntary effort and the support you provide to this cause. Please let us know if there is any other action you consider necessary to ensure the integrity of the domain.

Thank you again!