Author Topic: Site Blocked - URL:Phishing  (Read 52452 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31659
  • malware fighter
Re: Site Blocked - URL:Phishing
« Reply #150 on: March 06, 2019, 07:18:02 PM »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline bd1234

  • Newbie
  • *
  • Posts: 2
Re: Site Blocked - URL:Phishing
« Reply #151 on: March 07, 2019, 08:17:43 AM »
Hello. When i try to download files from site: bankrot.fedresurs.ru - it is blocked with "URL:Blacklist". Can you fix it ?
(for example: http://bankrot.fedresurs.ru/Download/file.fo?id=1604182&type=MessageDocument)

or how can i add this site to my avast exclusions ?
« Last Edit: March 07, 2019, 08:21:23 AM by bd1234 »

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31659
  • malware fighter
Re: Site Blocked - URL:Phishing
« Reply #152 on: March 07, 2019, 01:30:13 PM »
Dr. Web flags the site as a known infection source.
VirusTotal has following detections https://www.virustotal.com/#/domain/bankrot.fedresurs.ru
Most recent detection flag a Win32 EXE Express detection.
But wait for a reaction from an avast team member, to really know why they block it in the first place.
Scan won't finalize for me: https://urlquery.net/queue/04c4a750-ff33-4231-9977-f84f22954bb2
Also consider: https://otx.alienvault.com/indicator/domain/bankrot.fedresurs.ru
Detection: https://www.virustotal.com/en/file/eaa8f35c214908ae74a903a916b325b4d42b9703a1b4a49aad376a164f27f9bc/analysis/

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline jefferson sant

  • Starting Graphoman
  • *
  • Posts: 6206
  • volunteer
Re: Site Blocked - URL:Phishing
« Reply #153 on: March 07, 2019, 10:31:19 PM »
hello i have the same problem with my Website:
https://www.nghd.pt/
Can you unlock URL?

I submitted the URL and now the detection was removed today 07.03.19 at 10:33

Quote from: Avast
Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

Offline jefferson sant

  • Starting Graphoman
  • *
  • Posts: 6206
  • volunteer
Re: Site Blocked - URL:Phishing
« Reply #154 on: March 07, 2019, 10:33:48 PM »
Hi, I'm having problems with my website www.rndwss.com.
It seems recognize a phishing situation. Can you check it, please.
I can connect to it without any problem using the dedicated personal url provided by 1&1.
Regards,
Romano.

Detection was removed today 07.03.19 at 10:54

Quote from: Avast
Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

Offline jefferson sant

  • Starting Graphoman
  • *
  • Posts: 6206
  • volunteer
Re: Site Blocked - URL:Phishing
« Reply #155 on: March 08, 2019, 02:25:06 PM »
Hello. When i try to download files from site: bankrot.fedresurs.ru - it is blocked with "URL:Blacklist". Can you fix it ?
(for example: http://bankrot.fedresurs.ru/Download/file.fo?id=1604182&type=MessageDocument)

or how can i add this site to my avast exclusions ?

Detection was removed today 08.03.2019 at 07:20

Quote from: Avast
Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

Offline Andrew570

  • Newbie
  • *
  • Posts: 1
Re: Site Blocked - URL:Phishing
« Reply #156 on: March 08, 2019, 11:32:30 PM »
Hi, Avast thinks my website, www.flyfriendservice.com is phishing.

Can you tell me what I can do to either correct the problem, or have it removed from the blacklist?

Thanks!

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 60632
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Win 8.1 [x64] - Avast PremSec 19.8.2391.B#3 - CC 5.61 - EEK - Firefox ESR 60.9 [NS/AOS/uBO] - TB 68.1 [EM] - ABS/ACP/ASB/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31659
  • malware fighter
Re: Site Blocked - URL:Phishing
« Reply #158 on: March 09, 2019, 02:15:13 PM »
Could also be through some of the domains you share on that same IP.
https://www.ip-adress.com/ip-address/ipv4/162.241.253.90
See Bluehost hosting vulnerabilities here: https://www.shodan.io/host/162.241.253.90

Here you will find 361 recommendations for improvement for your website:
https://webhint.io/scanner/c4e48809-06ba-403b-8904-81f4fc7271c8
of which various recommendations touch security improvement:
https://webhint.io/scanner/c4e48809-06ba-403b-8904-81f4fc7271c8#Security

polonus (volunteer website security analyst and website error-hunter)
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31659
  • malware fighter
Re: Site Blocked - URL:Phishing
« Reply #159 on: March 09, 2019, 03:16:04 PM »
Re: https://aw-snap.info/file-viewer/?protocol=not-secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=d3c2LnB9XWp7XnRieXB8c3MuXl1tYDx6~enc

Why this site has been blocked. And why Google let me fill out a captcha to prove I am human, tryuing to go there,
e.g. to htxp://ww6.projectbypass.com/?z   trying to use to evade Google's geo-targeting, read: http://search.lores.eu/geotargeting.html

Anyone, why Google chrome browser blocks it or is it an ad-blocker of sorts?

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31659
  • malware fighter
Re: Site Blocked - URL:Phishing
« Reply #160 on: March 09, 2019, 05:19:59 PM »
Interesting, it may probably be this http://opay.in.siteindexed.com/
Opay.in on the search engines

Google Yahoo Bing

Example: http://foresttrailacademy.com.siteindexed.com/

Given as OK: https://www.virustotal.com/#/url/38c32e119aeee672c8cc37fc5fd68948f68f12cb60023731eed81f02436f0428/detection

Running - see: https://www.shodan.io/host/199.59.242.151
PORT   STATE SERVICE VERSION
80/tcp open  http    OpenResty web app server
|_http-server-header: openresty
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-trane-info: Problem with XML parsing of /evox/about

So we seem to have localised it as an website indexing service  ;D

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline bauerj

  • Avast team
  • Jr. Member
  • *
  • Posts: 62
Re: Site Blocked - URL:Phishing
« Reply #161 on: March 11, 2019, 07:45:13 AM »
Hi,
I removed both flyfriendservice[.]com and currenrv[.]com from our blacklist. Domains should not be blocked anymore.
Jirka

Offline tammi6

  • Newbie
  • *
  • Posts: 1
Re: Site Blocked - URL:Phishing
« Reply #162 on: March 11, 2019, 02:51:47 PM »
Hi :-)

We're also having an issue with our site https://travel-information.org/

It was previously hacked in 2018, but the site was recovered over 5 months ago. We've added an SSL certificate to the site to make it more secure, but it's still showing up as a phishing risk on avast.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 60632
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Win 8.1 [x64] - Avast PremSec 19.8.2391.B#3 - CC 5.61 - EEK - Firefox ESR 60.9 [NS/AOS/uBO] - TB 68.1 [EM] - ABS/ACP/ASB/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31659
  • malware fighter
Re: Site Blocked - URL:Phishing
« Reply #164 on: March 11, 2019, 04:43:43 PM »
Classified as a PHISH: http://trafficlight.bitdefender.com/info?url=http://travel-information.org
Look what it found here: https://fortiguard.com/search?q=http%3A%2F%2Ftravel-information.org&engine=1 (normal)
Just 181 recommendation towards website improvement:
https://webhint.io/scanner/215d7f5c-1591-425a-af09-3604320dc7c9

Wait for an avast team member to give the final verdict on your website
as we here are just volunteers with relevant knowledge
and only avast team members can come and unblock your website.

polonus (volunteer website security analyst and website error-hunter)
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!