False Positive | doc.clickup.com

[jstorozuk]

What are the subjects of the false-positive (domains, URLs, or IPs)?

doc.clickup.com

Why do you believe this is a false-positive?

Good Afternoon, 

I'm reaching out from ClickUp - an all in one productivity platform offering multiple services including Docs creation (similar to Google/O365 Docs) Forms, Task, Whiteboards etc.

Our docs service([https://docs.clickup.com], has been flagged by this service through Virus Total

We actively monitor and respond to all abuse complaints for user-generated content, and have processes and procedures in place to detect/remove malicious content daily.

We're requesting that you remove doc.clickup.com (the parent domain) from your blocklist. The User generated content will contain further details like doc[.]clickup[.]com/95656565065//d/6cgby2m-9135/ty501exp

Please let me know if we can provide any additional information.
Thank you,

ClickUp Security
[email protected]

How did you discover this false-positive(s)?

VirusTotal

Where did you find this false-positive if not listed above?

Listed Above

Have you requested a review from other sources?

No

Do you have a screenshot?

See https://www.virustotal.com/gui/url/0d712dc8e38efedae2ea101fe243a7d83f6cf69f8a2132738d153a6f902753db

Additional Information or Context

No response

[phishing-database-bot]

Verification Required

@jstorozuk, thank you for submitting a false positive report! To help us verify your ownership of the affected domain(s), please complete the following steps:

1. Set a DNS TXT record for the domain(s) listed in this issue with the following details:

   • Record Name: _phishingdb
   • Record Value: antiphish-eede8872f0c5f467efa3de9e2b50481dd37b82be

   Your Verification ID: antiphish-eede8872f0c5f467efa3de9e2b50481dd37b82be

2. Wait for DNS propagation (this may take a few minutes to a few hours).

3. Reply to this issue once the TXT record has been set.

Important Notes

• Verification does not guarantee whitelisting. The Phishing.Database team will review your report after verifying ownership, but the decision to whitelist depends on further investigation and analysis.
• If the record cannot be set or you need alternative methods of verification, please contact us at [email protected] - preferably from the domain's official email address.

How to Check the TXT Record ?

You can verify that the TXT record is properly set using:

• Online tools like Google's Dig Tool or MXToolBox TXT Lookup.
• The command line:

  dig TXT _phishingdb.example.com
  

Thank you for your cooperation! We will address your issue as soon as possible after verification.

The Phishing.Database Project Team.

[jstorozuk]

TXT record has been added. Thanks folks.

[spirillen]

Why, oh why, I was having my feet up, having a good time with a movie... now you disturbing my peace,

But ok, let me get to work

[spirillen]

nice... getting back to my armchair...

drill -t txt _phishingdb.clickup.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 15284
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 
;; QUESTION SECTION:
;; _phishingdb.clickup.com.     IN      TXT

;; ANSWER SECTION:

;; AUTHORITY SECTION:
clickup.com.    900     IN      SOA     ns-298.awsdns-37.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

;; ADDITIONAL SECTION:

[jstorozuk]

Txt record has been added for doc.clickup.com, we can make it for the parent if you wish.
;; ANSWER SECTION:
_phishingdb.doc.clickup.com. 300 IN TXT "antiphish-eede8872f0c5f467efa3de9e2b50481dd37b82be"

[spirillen]

Fixed in Phishing-Database/phishing@aae5735

[jstorozuk]

Thank you @spirillen

[spirillen]

Your welcome, so are donations: https://kb.mypdns.org/articles/MTX-A-3 😉