About reporting potentially malicious links

[Randissimo]

Guys, please do me a favor:
If you're reporting a potentially malicious link make it unlink-able and not pursuable.

worst example: http://www.google.com
bad example: http://www.google.com
still a bad example: hxxp://www.google.com ; http://ww.google.com ; hxxp://ww.google.com

You can follow links on right-click even if you copy only the latter part from a URL, in this example "google.com", therefore masking the first part is not an option to make a 100 percent sure no one could accidentally land on the page.

So the best option would be to alter the last part, for example:
http://www.google[dot]com or http://www.google .com (with space between the top-level domain and the middle part) or just leave out the dot, e.g.: google com or googlecom.

Thank you for your understanding.

edit: sorry, but this linking in this forum is even worse.
You need to mask both the http: part and the last part, for example:
hxxp:www.google[dot]com
another test with ww.google .com
test passed,
next test: www.google .com
test failed,
next test: google .com
test passed

2nd edit: either leave out the http and/or www. part or mask them too.

3rd edit: due to the nature of the automatic linking, the part which I've considered the "best option" at first, is actually a bad example. The real best examples are the ones in my first edit which passed the test that they are both unclickable and unfollowable.

[polonus]

Hi Randisisimo,

Thanks for reporting your concerns.
What if one reports scan links. Does not need rocket science to reconstruct the destination and it is purchasable for self-inflicting characters  .
Most problems arise from n00b posters here. These live links have to be worked on by moderation from avast! to get them properly unlink-able.
And we are not staff, so we can only set a good example.
Only thing we can do is ask to properly unlink or ask moderation to do that for us.
Another problem is that links can now be re-linked automatically as with mail addresses, so either do not give any mail address or mask it.
Automated spamming has created a very insecure circuit there.
Then there are those that oppose to scan results here, because they won't want to be reminded to an incident, so others may not learn about their mistakes.
Those requests are questionable.
I never go any further than remote cold reconnaissance scanning, that means never going to the potentially malicious link as such.
This also goes for the results.
Never give live or broken script only give as for instance a jsunpack link reference, even on Quttera results.
Give results also as an image (threatSTOP IP results).
We have seen now that the recommended scanner of sorts, Sucuri, now brings site scan results as largely being obscured,
while sites like fetch dot scritch dot org and BuiltWith give quite some bit of reconstruction-able info that could be dangerous in the wrong hands.

On the other site we see an enormous amount of sites that could be malvertised any moment because of outdated CMS and server insecurities (excessive header info proliferation) etc, etc.
 You cannot stop all these imminent dangers just by security through obscurity, although I strongly agree with a proper non-clickable link policy.
 I agree for instance also with Dazzlepod's policy that their scan results cannot be used against a particular site as is their general policy.
It should always be the policy to first report to avast AT virus DOT com (masking this mail address is futile now!)
and then discuss scan links or discuss certain aspects of threats  here.
It is a pity that in most cases one needs a full plethora of scanners to detect any potential malicious links or bad or worse  policy practices.
This means that in a lot of cases website security policy comes as a last resort issue.

polonus
 

[DavidR]

The point of is to avoid accidental exposure by the fact that the link isn't show in the forums as an active URL link; so they have to do something else to actually get to the site/url.

Some of your examples that you give and consider bad/failed, don't actually go to the site in the url. There are many ways so that the url is displayed as text and not an active link and it doesn't need to be munged in multiple locations for it to be a text based url that isn't active (click-able and goes to the correct url)..

[Randissimo]

Some of your examples that you give and consider bad/failed, don't actually go to the site in the url.

You mean that one: http://ww.google.com;?
If it wouldn't be for the semi-colon, you could still easily mark the "google.com" part and open the link from the right-click context menu.
I've made a little more space between them, because they only served as parting compounds between the examples.

@polonus:
Thx for the detailed answer. As if it wouldn't be enough that this forum automatically links sites, even only masking the latter part would make them directly linkable, see for example those two examples I've considered "best examples" at first, because I didn't know about the auto-linking feature. (I've got to edit that part, too.)
However, even if some people take considerable effort to make them unclickable, it's not enough in my opinion.
In this posting from you there are about 5 links which could be accidentally accessed while clicking with the right mouse button to copy the marked URL for a scan or web search.

edit: only the main domain is followable with the context menu, so there are only 5.


 

[polonus]

Hi Randissiomo,

Always see these things into the right proportions.
So we should ban various online website scanners as they are doing exactly that, without even breaking the links properly -> http://maldb.com/  etc.

Whenever I visit a website malcode analysis thread on the virus and worms section of an av solution support forum.
I should be fully aware that I could come across such reconstruct-able links.
Same going over the contents of qualified malware removers here. Some reconstructable links, even more dangerous in the hands of the unwise to serve up as a cure for all when designed for just one specific victim. What is your critique there? I am anxious to hear that?

Breaking a link i.m.h.o. is just the opposite of saying "please click here and get yourself infested".
This is not kindergarten! It is the avast! support forum - virus and worms section.
Always take precautions as I state in my profile use NoScript and visit in a sandbox or a VM and be more secure.
Just like going somewhere for the first time on the Interwebs, pre-check link with cut and past or bringing up a link checking service,
then shun site or visit or ask a second op here or visit through a online proxy with script disabled and in a sandbox. No risks!

If you are going here: http://cybercrime-tracker.net/ all the URLs given there are lively dangerous.
Clear it says cybercrime tracker and not pussycat tracker  .
and one can click the VT results to seee what the actual threat is.
No one in his right mind is trying to go to the live URLs there period or you are a kind of "sado-masochistic" self-infesting clicker

Not only go to the website analysis with a scriptblocker and in a sandbox or virtual machine.
Also be cautious with sites like ZuluZscaler, Quttera etc.
Too much of malcode (without payload natyrally) exposed and access will be denied by avast! shields.
So with code use an image that is safe.

So the only thing to do with these links, broken or reconstructable ones, is cut and paste to be fed to a scanner of sorts. Never click there.
In most cases one is halted by Google or WOT or BitDefender's TrafficLight, so it is rare to actually be able to go there.

I know there are people that like to see the effects of their clicking and well they will find out. Hope they will never come across a file-infector.

Just like with a child. When I say "Do not go to the hot stove, it is hot" and that child will burn its finger anyway,
it will know what it should not be doing the next time.

Well the risk of something happening is relative.
Most active malware is only up for a very short time before being detected or cleansed or taken down or going dead.
We also should hammer on the responsibility of those that click.

Not updated and upgraded your OS and third party software?
You forgot to use the avast software updater? You click and get infested,.
You yourself are to blame.

But we can tell that one thousand million times. Will they ever learn. I think they will not.
People will only start to act differently when they have turned their computer to function "door stopper only".
Same with idiot webmasters and irresponsible hosting.
Everybody that goes onto the road needs a driving licence.
On the other hand every idiot that knows to put a website up or host 2000 domains on one and the same IP is free to endanger each and every visitor.

To change that situation should be priority one, and then users should get educated and security should no longer be a last resort thing.

Not doing anything about this and leave things as they are and moaning about a reconstruct-able link.
that once in a blue moon could infect a persistent self-inflicting clicker that wants to bring that upon himself intentionally should be a second concern.

We take all precautions and report to make these very users more secure.

polonus

[DavidR]

Some of your examples that you give and consider bad/failed, don't actually go to the site in the url.

You mean that one: http://ww.google.com;?
If it wouldn't be for the semi-colon, you could still easily mark the "google.com" part and open the link from the right-click context menu.
I've made a little more space between them, because they only served as parting compounds between the examples.
<snip>

There were others, but is not the point. We are talking about accidental exposure (clicking on a complete and active url), having to select the text and use the right click option is hardly accidental.