website

Ouch…Emotet malware found on their website is quite alarming

Hi, first, we take security very seriously, we run many scans and did many tests, I can clarify that we do not have any malware on our website. we also contacted Malwarebytes and asked to remove this block, it might be a IP block that is not related to our website.

In general, there is no relation between zorem.com and the plugin files so you have nothing to be afraid of and not any security issues. , this is not any issue related to the plugin, I hope it will be resolved in the next hours.

• This reply was modified 5 years, 8 months ago by Zorem.

@zorem There seems to be some evidence showing malware did exist on May 16 and May 17 2019:

CONTENT-DISPOSITION: attachment; filename="file_71795834_D532.doc"
X-POWERED-BY: PHP/7.0.27
CONTENT-TRANSFER-ENCODING: binary
SET-COOKIE: __cfduid=d47a560e5fbdbfee2d69bc9abe5c957a11558038501; expires=Fri, 15-May-20 20:28:21 GMT; path=/; domain=.zorem.com; HttpOnly; Secure, 5cddc7e68d60f=1558038502; expires=Thu, 16-May-2019 20:29:22 GMT; Max-Age=60; path=/
EXPIRES: Thu, 16 May 2019 20:28:22 GMT
SERVER: cloudflare
LAST-MODIFIED: Thu, 16 May 2019 20:28:22 GMT
CONNECTION: keep-alive
TRANSFER-ENCODING: chunked
PRAGMA: no-cache
CACHE-CONTROL: no-cache, must-revalidate
DATE: Thu, 16 May 2019 20:28:22 GMT
CF-RAY: 4d8018fca9e879b3-SEA
CONTENT-TYPE: application/msword

Hi, first, there is no relation to this plugin. The docs website is not connected in anyway to this plugin. Second, I just got a notification that this website was whitelisted for their next update.

@zorem I understand the website and the plugin files are hosted on separate servers, but are you able to confirm that malware did exist on your website 16 May 2019 and 17 May 2019? I’m not trying to be argumentive, but I think it is unethical for a website owner to not confirm or deny a security compromise occurred when they are asked about it.

@zorem If your official documentation website has a virus, we will close your plugin for directing people to places that make them insecure. As a plugin developer you are responsible for your plugin and any site you direct users to. Please keep that in mind.

Hi, @ipstenu, I totally understand, We take security very serious.
I can confirm that there is no virus on this website, this is a WP website, secured, we run all checks, checked every plugin and every file for security, confirmed it with Sucuri tests and other security plugins and also with our hosting provider and I also asked the malwarebytes team to remove these unsecure message they display to their users and they confirmed they whitelisted them but it might take time:
https://forums.malwarebytes.com/topic/248936-website-is-blocked-by-malwarebytes/?tab=comments#comment-1320186

In addition, we will temporary remove these links from the readme file.

Let me know if i should take more actions.

Thanks