Avast WEBforum

Consumer Products => Avast Online Security (browser extension) => Topic started by: Jim483 on October 11, 2021, 12:32:05 PM

Title: Avast blocks survey platform as Bot Net
Post by: Jim483 on October 11, 2021, 12:32:05 PM

We use a survey platform embedded in Constant Contact for our weekly e-zine. Recently, links to a survey has been blocked by Avast as infected by a bot net. Here's the link:

hXXps://r20.rs6.net/tn.jsp?f=001tyROGsp_gAYWcrlZNcKlgsvdnZoP99UT3W9zCfub4ryXlAU3l6Mew4ibHgi1tSuP4igz4olkdytWqiP3AXa5I-F1jLnJ94Jk17V0sULrGB20AmvGIgjeyE24FO6kJHHGnIQtori-mikvTl0OeZibRqA7cbLAl4H-&c=lKFxI5hB4k7lWB9yYjtO3l9ADGar7A-r94i57V2YHw0e9WrW92S50A==&ch=vaeQ6W0GqpLLVk57Z8e4WH9EV35sIa5bro5z2qv8-sUteL0l9OCVww==

We've used this survey platform for a while without problems. Thanks JB

Title: Re: Avast blocks survey platform as Bot Net
Post by: DavidR on October 11, 2021, 12:37:41 PM

Please 'modify' your post change the URL from https to hXXps, to break the link and avoid accidental exposure to suspect sites, thanks.

Title: Re: Avast blocks survey platform as Bot Net
Post by: Jim483 on October 11, 2021, 12:59:15 PM

Corrected. Sorry for the rookie mistake. JB

Title: Re: Avast blocks survey platform as Bot Net
Post by: Asyn on October 11, 2021, 01:08:26 PM

-> https://sitecheck.sucuri.net/results/r20.rs6.net

Title: Re: Avast blocks survey platform as Bot Net
Post by: polonus on October 19, 2021, 06:48:49 PM

See what abuse the of that site IP kicks up: https://www.abuseipdb.com/check/208.75.122.11
Scumware detects it here: https://www.urlvoid.com/scan/r20.rs6.net/

But wait for a final verdict by avast team, as they are the only ones to come and unblock.

Here it is given green: https://www.virustotal.com/gui/url/ab566143a6bc92713ce6a99a5830e23b4fff09359f287ebf3cfcbf96bcfa141c/detection

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

Title: Re: Avast blocks survey platform as Bot Net
Post by: polonus on October 22, 2021, 11:16:47 AM

Normally adblockers like uBlock Origin will block r20.rs6.net as tracker.
Address is also blocked in adblocking browsers, like epic's.

polonus