My company's legitimate websites have been blocked by SmartScreen

Question

Hi guys,
I have quite a serious problem going on at the moment. My company's legitimate websites have been blocked by Internet Explorer's "SmartScreen" and our end users are complaining.
The two sites in question are:
http://www.endeavour.edu.au
http://learn.endeavour.edu.au
I find it hard to believe, that our websites can simply be blocked by this SmartScreen filter, without providing us with any evidence, or even contacting us to verify the legitimacy of our website.
We are an educational institution and are obviously in no way affiliated with any malware or phishing and in no way have our websites been spreading malware or phishing attacks.
How can Microsoft simply add our site to a "blacklist" of sorts, without properly and correctly reviewing our site to confirm what has been reported? I find this to extremely unprofessional and even be classed as defamation.
The fact that we can only "Report that this site does not contain threats" and not even contact anyone at Microsoft to confirm any details is astounding.
Does anyone know how to quickly get these false positives reversed?
Thanks,
Nino

Answer 1

Hi,
from what I can see
https://learn.endeavour.edu.au/login/index.php is leaking user details to third-parties via the social networking buttons (which are not using the https protocol)
f12>Console tab, refresh the page...to display the error messages for the page.
DOM7011: The code on this page disabled back and forward caching. For more information, see:
http://go.microsoft.com/fwlink/?LinkID=291337
File: index.php
SCRIPT16389: Unspecified error.
File: index.php, Line: 1, Column: 1
HTML1300: Navigation occurred.
File: index.php
HTML1508: Unmatched end tag.
File: index.php, Line: 78, Column: 1
SEC7111: HTTPS security is compromised by
http://learn.endeavour.edu.au/_files/images/HE.png
File: index.php
SEC7111: HTTPS security is compromised by
http://learn.endeavour.edu.au/theme/image.php?theme=essential2&component=theme&rev=1429666221&image=bg%2Fbody
File: index.php
SEC7111: HTTPS security is compromised by
http://cld-vid02.endeavour.edu.au/p/104/sp/10400/embedIframeJs/uiconf_id/6709411/partner_id/104
File: index.php
SEC7111: HTTPS security is compromised by
http://learn.endeavour.edu.au/local/kaltura/js/frameapi.js
File: index.php
It looks like you are using a WordPress theme that may be malware.... what is HE.png?
http://vet.endeavour.edu.au/login/index.php on the other hand does not invoke the SmartScreenFilter.
f12>Console tab.....
DOM7011: The code on this page disabled back and forward caching. For more information, see:
http://go.microsoft.com/fwlink/?LinkID=291337
File: index.php
SCRIPT16389: Unspecified error.
File: index.php, Line: 1, Column: 1
HTML1300: Navigation occurred.
File: index.php
HTML1508: Unmatched end tag.
File: index.php, Line: 78, Column: 1
Kaltura HTML5 Version: 1.7.0.8
My guess is......
1. Get your site verification code from Google
https://support.google.com/webmasters/answer/35179?hl=en
and add the appropriate meta tag to your landing page. (actually you should clear up your dns records first, so that you have the one IP address with several aliases.)
2. Remove your 'social' buttons and other third-party content from your sign-in pages. You should not use unsecured content from third parties on login pages. (google analytics.... do you really need to know how many visitors bounced on your login pages?)
3. contact your hosting provider.... the who-is records look out of date/incorrect... I would expect the same IP address for your sub-domains, but they have been mapped to different IP addresses.
I would expect the ONE IP address for endeavor.com.au with records for the several aliases that you are using on the sub-domains.
Address lookup
canonical name
endeavour.edu.au.
aliases
www.endeavour.edu.au, + learn.endeavour.edu.au, vet.endeavour.edu.au etc.
addresses
117.20.11.60
(you sites are using different IP addresses for each sub-domain).
see
http://centralops.net/co/DomainDossier.aspx?addr_lkup=1&dom_whois=1&net_whois=1&dom_dns=1&traceroute=1&svc_scan=1&addr=www.endeavour.edu.au
and
http://centralops.net/co/DomainDossier.aspx?addr_lkup=1&dom_whois=1&net_whois=1&dom_dns=1&traceroute=1&svc_scan=1&addr=learn.endeavour.edu.au
BUT!
these are peer to peer support forums... we do not work for nor represent MS.
Your best option is to submit a request via the Fishing Filter link or to contact MS Australia (support.microsoft.com) who MAY be able to give you more concrete reasons why the site(s) are being reported as unsafe.
Regards.
Rob^_^