Avast WEBforum

Consumer Products => Avast Online Security (browser extension) => Topic started by: Charbel3 on February 21, 2020, 06:26:16 AM

Title: Website being blocked as Phishing
Post by: Charbel3 on February 21, 2020, 06:26:16 AM

Hi Team

We are having major issues with our company website. The site is https://zip.co

ALL urls containing ZIP.co are being marked as PHISHING (see attachment). This is happening with both AVAST and AVG browser checked. With have logged multiple false positives and called numerous numbers. We cannot get any traction. This is having major issues with revenue as customers cannot transact.

When searching Virus Total, Talos, and every other reputable company, out site is not blacklisted. Only AVG and AVAST are.

Can we please have this urgently looked at as it is impacting our business?

Charbel

Title: Re: Website being blocked as Phishing
Post by: Asyn on February 21, 2020, 06:29:13 AM

-> https://sitecheck.sucuri.net/results/https/zip.co
-> https://www.virustotal.com/gui/url/f5bf3601adbf2b8e226ef00a3baf37245ef77c6ab72b0508806568cc9abc08fb/detection

You can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php

Title: Re: Website being blocked as Phishing
Post by: Charbel3 on February 21, 2020, 06:40:16 AM

Thank you for proving that there is nothing wrong with our site.

We have logged a number of times that there is a false positive. I am yet to receive a confirmation that someone is looking into this.

Title: Re: Website being blocked as Phishing
Post by: Asyn on February 21, 2020, 06:57:19 AM

You're welcome.

Title: Re: Website being blocked as Phishing
Post by: polonus on February 21, 2020, 09:52:50 AM

More than likely the detection is IP-related because of existing abuse on Amazon (trade-doubler etc.):
https://www.virustotal.com/gui/ip-address/13.249.134.9/relations
Threat DGA detected.
XSS-DOM sinks and sources: results from scanning URL: -https://zip.co/polyfills-es2015.86d53968b5707fa5dc24.js
Number of sources found: 379
Number of sinks found: 67

Consider also: -https://4qltfsar50.execute-api.ap-southeast-2.amazonaws.com/production/merchant?id=%255B7184%252C2312%255D
Blocked for me: -cdn.optimizely.com

Wait for a final verdict from an avast team member. They are the ones to come and unblock.

Seems site has already been unblocked.

polonus