Avast WEBforum

Other => Viruses and worms => Topic started by: congotobacco on March 24, 2021, 01:18:04 PM

Title: URL: Phising
Post by: congotobacco on March 24, 2021, 01:18:04 PM

Sorry if i am breaking community rules, but no response on false positive flag, and we cosider warning and site blocking is wrong:
https://www.virustotal.com/gui/url/787d3ab6ba528f5a9bd5b9c1c98d7845bd8464220ecffdd0962173bc7d7794d5/detection
https://urlscan.io/result/188c9a0a-2b38-49a1-9622-b7d9d0e753b5/

Title: Re: URL: Phising
Post by: polonus on March 24, 2021, 10:42:14 PM

It is not avast, there is a site issue. Website cannot be scanned, see: https://sitecheck.sucuri.net/results/www.balkandownload.org

What is this script doing?

Quote

<script type="text/javascript"><!--
var host = 'wXw.' + 'balka' + 'ndownload.' + 'org';

if (window.location.hostname !== host){
window.top.location.href = 'hxtp://' + host + '/';
}
//--></script>

Outgoing link = https://www.cloudflare.com/5xx-error-landing

So you are barking at the wrong tree and should address this issue at CloudFlare's

Quote

You were visiting a Cloudflare customer’s website, and something went wrong. Don’t worry, it’s not your fault. If the problem isn’t resolved in the next few minutes, it’s most likely an issue with the web server you were trying to reach.

polonus (volunteer 3rd party cold recon website security analyst and website eror-hunter)

Title: Re: URL: Phising
Post by: polonus on March 25, 2021, 12:12:37 PM

Also consider cert errors, Re: dc-733221ef6970.balkandownload.org
here: https://ssl-tools.net/mailservers/dc-733221ef6970.balkandownload.org
& https://ssl-tools.net/subjects/e35e37b61faaf57c112fcd2b2f2be458c54877cc#277378bf72

polonus