4

I recently purchased a domain and set up hosting at AWS for the root and a subdomain for the static asset files, set to CloudFront.

After a brief public test, I received many issues from customers saying content was being blocked by ISPs. After deeper investigation, it appears the root of the problem is Akamai's product Nominum has blocked the domain for malware. Because the domain is so new to me, I assume it was blocked prior to my owning it.

I've reached out to abuse@akamai, called their support line, chatted with their sales people and pinged them on Twitter, all to no avail.

Does anyone know how to get a domain unblocked by Nominum?

2
  • Did you run malware scan for your website? check in google site:yourisite.com and see if any of the page or root domain giving malware message. Double-check that your pages are available and clean. Feb 5, 2019 at 9:59
  • Thanks for the response. Yes, I did check Google, but that doesn't seem to be the problem. The problem was with Swisscom and Virgin ISPs. We were able to contact someone at Swisscom who said the malware block came from Akamai. I've still been unable to get in contact with anyone from there.
    – Josh
    Feb 6, 2019 at 14:49

1 Answer 1

4

Yes, the problem is indeed with the Akamai Nominum blacklist, and we have been having this issue for over 5 years with no resolution. The issue is that they are using the Suppobox DGA list supplied by Bambanek, and blocking any domains that appear on that list. The issue is that this list is just a mashup of words, and has a very high false positive rate: https://osint.bambenekconsulting.com/manual/suppobox.txt

"FALSE POSITIVE RISK: High

OTHER NAMES KNOWN AS: none

Suppobox is a word based DGA and as such, can have many collisions with legitimate domains. In the case of Suppobox, this risk is high. The DGA is date and time seeded using two wordlists to create the domains. All domains end in .net."

It's been very frustrating trying to get whitelisted by Akamai. Eventually I managed to contact an executive at Akamai and he managed to get us onto their global whitelist. However, after a few years the blocks started happening again, and Akamai refuse to even talk to us. I sent a cease and desist letter to them, which they received, but that hasn't stopped the blocks.

The only solution is to contact ISPs who use Akamai's DNS, and get them to whitelist your domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.