One of our very large clients sent us an email stating that the doctors working at an extremely high profile hospital were unable to access their website (our client’s Joomla website). The email stated that the website was timing out for them.
At first, we thought it was a browser issue (since large companies tend to use the same browser, and it’s often an old version of Internet Explorer with weird patches), but then we ruled it out because the IT director (who communicated directly with us), was also unable to to access the website from a different browser. The staff were able to access the website from their mobile devices (which were using a different network than the hospital’s network), but they weren’t able to access the site from the hospital’s network.
We then asked the IT Director to check with his networking team whether the website was blocked at the firewall level, and the immediate feedback was that the website wasn’t blocked. Perplexed, we started searching for another cause of the problem, and so we checked our client’s logs and we noticed that the doctors were hitting the website, but for some reason, they were getting a 301 redirect and that’s it – the connection ends and the browser stops asking the server for further content. We scavenged through all the security modules that are installed on the server thinking that that network was blocked somewhere, but we were unsuccessful at finding anything.
We then asked for a traceroute, and we were sent one immediately, but, to our disappointment, the IT Director was able to successfully tracert to our client’s website. Hmmm… The IT Director then asked us for a traceroute from our server to theirs, and something interesting happened: the traceroute failed as soon as it reached their network, which means that they’re not accepting traffic from our (client’s) server!
A few minutes later, the IT Director emailed us and told us that they resolved the problem on their end, stating the following reason: “HP has an IPS (Intrusion Prevention System) application named Tipping Point. A reputation database (refreshed from HP’s dvlabs feed) is integrated into that IPS. Your website had a bad rating and that’s why it was blocked. We resolved the problem by locally whitelisting your website.”
He then sent us the following snapshot:
As you can see from the above picture, the website has been labeled as carrying a “Network Worm” for nearly a month. Clearly, we needed to contact HP’s tipping point about this issue (we were confident that the website was clean). Here’s what we did:
- We called HP’s Tipping Point Support at +1 866 681 8324 (you can find the global phone numbers here).
-
We supplied the agent with the needed information (our client’s website, the account information of our client’s client) and we asserted that the website was very clean and not hacked.
-
The agent was very courteous and told us that they get a lot of false positives on the dvlabs database, and that the reason why our client’s website was categorized as a “Network Worm” is because they possibly received an abnormal amount of traffic from the website at one point or another. The agent confirmed that he will escalate that the problem to the dvlabs team, and, if the website is proven to be clean, then it will be removed from their blacklist and the change will be reflected once their data feed is refreshed.
-
We thanked the agent who told us to wait for the email. That was back on Friday (January the 2nd).
-
On Tuesday, we received an email from the agent apologizing for the wait, and telling us that the website has been removed from the blacklist.
-
We rejoiced and we informed our client and the IT director of the hospital!
As you can see, it is not that hard to remove a website from HP’s Tipping Point blaklist (e.g. the dvlabs database) – it just needs a bit of patience. It is also not a bad experience (we were very surprised with HP’s pro-activeness, professionalism, and friendliness towards this whole issue).
If some of your clients cannot see your website because it has been blacklisted by HP, then make sure it is clean, and then contact them (they do answer the phone immediately). If you need help in the process, then please contact us. We have done it before (and it did work), we are resilient, we work hard, and we don’t charge much!