topic Re: Brightcloud tagging Yahoo sites as Phishing and Fraud in General Topics

Brightcloud tagging Yahoo sites as Phishing and Fraud

cloughr — Wed, 30 May 2012 14:36:41 GMT

Greetings!

Today I received several helpdesk calls concerning yahoo! mail not working. Logs show that the 'yming.com' site that yahoo! uses is being flagged as a 'Phishing and Fraud' site.

I know I can report it (24-48 hour fix) and can manually unblock, but what a pain. Is anyone else seeing this issue?

Re: Brightcloud tagging Yahoo sites as Phishing and Fraud

u7483 — Wed, 30 May 2012 14:37:44 GMT

I am out of the office on 5/29 and 5/30 and will be back in the office on 5/31. If you need immediate assistance, please contact the Help Desk.

Re: Brightcloud tagging Yahoo sites as Phishing and Fraud

mikenh — Wed, 30 May 2012 14:43:55 GMT

When I load yming.com it goes to one of those pesky (probably malicious) fake search pages. For us - haven't run into any Yahoo blocks and we are running current content.

Cheers,

Mike

Re: Brightcloud tagging Yahoo sites as Phishing and Fraud

cloughr — Wed, 30 May 2012 15:00:15 GMT

Weird. I know that several of our folks had this problem, and unblocking yimg.com was the fix..

Re: Brightcloud tagging Yahoo sites as Phishing and Fraud

dyang — Wed, 30 May 2012 15:51:35 GMT

Hi Everyone,

There was indeed an issue with a site that is associated with Yahoo Mail.

Some quick background - mail.yahoo.com has always been correctly classified, and mail.yimg.com (which provides content for mail.yahoo.com) has always inherited its categorization from yimg.com, which has historically been categorized as internet portal.

However, a blackhole exploit and javascript used in some phishing attacks was found on the following URL on 5/16/2012:

mail.yimg.com/zz/combo?/nq/mc/15_0_2/js/yui_utils.js&/nq/mc/15_0_2/js/core.js&/d/lib/bc/bc_2.0.4.js&/nq/mc/15_0_2/js/darla.js&/nq/mc/15_0_2/js/async.js&/d/lib/ult/ylc_1.9. on

As a result, BrightCloud changed the category for mail.yimg.com to Phishing, which then caused Yahoo Mail not to load properly if customers had a policy to blocking Phishing.

BrightCloud quickly realized this mistake and corrected the categorization for mail.yimg.com (it is now web-based email, since it is linked to mail.yahoo.com) and published a new database for it. For those customers that were affected by this, the cache entry should automatically be corrected when you download a new BrightCloud database (this is usually done by default on a daily basis - check your software update schedule).

Hope this helps,

Doris

Re: Brightcloud tagging Yahoo sites as Phishing and Fraud

mikand — Wed, 30 May 2012 19:52:45 GMT

Thanks for great feedback! 🙂

Re: Brightcloud tagging Yahoo sites as Phishing and Fraud

cloughr — Wed, 30 May 2012 22:10:46 GMT

Thanks, love to know the details!