{"id":3588,"date":"2017-06-26T16:50:11","date_gmt":"2017-06-26T22:50:11","guid":{"rendered":"https:\/\/www.whitefirdesign.com\/blog\/?p=3588"},"modified":"2017-06-26T16:50:11","modified_gmt":"2017-06-26T22:50:11","slug":"sitelock-is-for-some-reason-labeling-spam-links-as-malware","status":"publish","type":"post","link":"https:\/\/www.whitefirdesign.com\/blog\/2017\/06\/26\/sitelock-is-for-some-reason-labeling-spam-links-as-malware\/","title":{"rendered":"SiteLock is For Some Reason Labeling Spam Links as Malware"},"content":{"rendered":"<p>We often have people coming to us looking for advice after an interaction with the web security company SiteLock. That frequently involves claims by SiteLock that a website contains malware. Not only is the claim not always true, but in some instances the files they have labeled as being malicious don&#8217;t really make sense as being malicious (compressed database backups for example). Back in February we ran across what looks to be part of the explanation for this, SiteLock&#8217;s malware scanner labels evidence of non-malware based hacks as malware.<\/p>\n<p>In that instance it involved SiteLock&#8217;s <a href=\"https:\/\/www.whitefirdesign.com\/blog\/2017\/02\/15\/sitelock-and-bluehost-falsely-claimed-a-website-contained-malware-due-to-sitelocks-poor-scanner\/\">detection of a website defacement (they were identifying the wrong website as being defaced though), which they were labeling as malware<\/a>. Back in May we ran across a tweet from <a href=\"https:\/\/www.whitefirdesign.com\/blog\/2017\/05\/22\/sitelock-incorrectly-labels-spam-content-in-databases-as-malware\/\">SiteLock that seemed to be saying that they would also label spam comments in a database as malware<\/a>. It turns out that when it comes to spammy content this also applies to spammy links.<\/p>\n<p>Here is screenshot we were forwarded while providing a consultation recently, showing a spam link being identified as malware and being labeled &#8220;SiteLock-HTML-SEOSPAM-iar&#8221;:<\/p>\n<p><a href=\"https:\/\/www.whitefirdesign.com\/blog\/wp-content\/uploads\/2017\/06\/sitelock-malware-scan-result-spammy-link-labeled-malware.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3591\" src=\"https:\/\/www.whitefirdesign.com\/blog\/wp-content\/uploads\/2017\/06\/sitelock-malware-scan-result-spammy-link-labeled-malware.jpg\" alt=\"\" width=\"434\" height=\"475\" srcset=\"https:\/\/www.whitefirdesign.com\/blog\/wp-content\/uploads\/2017\/06\/sitelock-malware-scan-result-spammy-link-labeled-malware.jpg 434w, https:\/\/www.whitefirdesign.com\/blog\/wp-content\/uploads\/2017\/06\/sitelock-malware-scan-result-spammy-link-labeled-malware-274x300.jpg 274w\" sizes=\"auto, (max-width: 434px) 85vw, 434px\" \/><\/a><\/p>\n<p>Seeing as website malware refers to either malicious code being served to visitors of a website or malicious code that is in the underlying files or database that that generate a website, labeling spammy links as malware isn&#8217;t accurate.<\/p>\n<p>Why SiteLock is doing this isn&#8217;t clear. It could be as simple as lack of understanding of what they are doing. While they promote themselves as the &#8220;global leader in website security&#8221;, there is plenty of evidence out there that <a href=\"https:\/\/www.whitefirdesign.com\/blog\/2017\/04\/24\/sitelock-threat-intercept-falsely-claims-that-widely-known-backdoor-code-isnt-recognized-as-a-threat\/\">really don&#8217;t know much on the subject<\/a>. It also could be intentional. Someone would probably be more likely to order a $100 a month protection plan (which their <a href=\"https:\/\/www.whitefirdesign.com\/blog\/2017\/02\/06\/when-you-get-in-touch-with-sitelock-you-are-dealing-with-a-commissioned-sales-person\/\">commissioned sales people<\/a> are often trying to sell people on) if you told them they had malware on their website instead of a spam link. This also makes it harder for another security company to figure out what is going on, because if they look for malware on the website and don&#8217;t find anything they might reasonable assume they missed something that SiteLock had found.<\/p>\n<p>This all is good reminder for anyone dealing with a claim from SiteLock that a website contains malware, to get evidence from them as to what they are claiming is the malware as that should go a long way to clearing up if it is fact malware, some other type of hack, or a false positive. If you have gotten that information from them about a claimed malware issue with your website and are still not sure what is going on, we are always happy to provide a second opinion on the issue.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We often have people coming to us looking for advice after an interaction with the web security company SiteLock. That frequently involves claims by SiteLock that a website contains malware. Not only is the claim not always true, but in some instances the files they have labeled as being malicious don&#8217;t really make sense as &hellip; <a href=\"https:\/\/www.whitefirdesign.com\/blog\/2017\/06\/26\/sitelock-is-for-some-reason-labeling-spam-links-as-malware\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;SiteLock is For Some Reason Labeling Spam Links as Malware&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[39,137],"class_list":["post-3588","post","type-post","status-publish","format-standard","hentry","category-bad-security","tag-sitelock","tag-sitelock-html-seospam-iar"],"_links":{"self":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3588","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/comments?post=3588"}],"version-history":[{"count":2,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3588\/revisions"}],"predecessor-version":[{"id":3592,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3588\/revisions\/3592"}],"wp:attachment":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/media?parent=3588"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/categories?post=3588"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/tags?post=3588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}