Author Topic: Site Blocked - URL:Phishing  (Read 64214 times)

0 Members and 1 Guest are viewing this topic.

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2681
  • Volunteer
Re: Site Blocked - URL:Phishing
« Reply #420 on: October 18, 2019, 02:10:49 PM »
3. Assuming that there was a good reason at one time in the past, why is it still on the list? Don't you guys check these things? Or is it damned once then damned for all time? Not every website that has an issue was designed to be bad. Some could have been attacked and hacked by outside people. Don't you believe that these problems could be eventually found, fixed , and security tightened up?

A bit over a year ago, something hacked the site and a separate subdirectory tree was planted. This was ripped out and, currently, nothing that does not belong there is there.

See, now we're getting somewhere... Instead of half-assed accusing Avast! of not caring about customers, would it not have been simpler to say "We got hacked a year ago, we cleaned it up, can you check and confirm, and remove our website [from your list] accordingly?"? It's a lot simpler, and a hell of a lot more civil. I would argue that Avast! must care about it's customer's if they've chosen to block a webpage that had been compromised.


Quote
But avast details reports URL:Phishing with the offending URL being
http://omegacomputerservices.ca/bootstrap/css/bootstrap-responsive.css   one time and
http://omegacomputerservices.ca/bootstrap/js/jquery.js                            another time
and eventually just about every file in that directory tree. If there were an actual problem, it would not move around from file to file.
Avast! likely blocked your entire domain, not a specific file. That behaviour is not uncommon on any platform, Avast! or otherwise.


Quote
From this forum I did discover  sitecheck.sucUri.net  and
https://sitecheck.sucuri.net/results/omegacomputerservices.ca
says the site is clean.
OK, that's one check... What about the other half dozen? There are websites that I don't even know about. The basis for a detection is not made solely off one website typically. I have reported your domain to Avast! for re-evaluation. I will draw the attention of Milos to this thread as well.


A note for other platforms that detect you. Be honest, don't beat around the bush - tell them you were hacked a year ago, and cleaned it up (as opposed to saying.. "Maybe their was a reason?" then "Yes, we were hacked"). And be civil, otherwise they may just ignore you.
*Volunteer*.
Tier I SOC Analyst; Threat Hunter; Digital Forensics (no cert); HTB Competitor; Pentester (no cert).

4th Year BCS Student @ The University of New Brunswick.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 61524
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Site Blocked - URL:Phishing
« Reply #421 on: October 18, 2019, 02:20:22 PM »
Well said Michael..!! :) 8)
Win 8.1 [x64] - Avast PremSec 19.9.2394.B1 - CC 5.63 - EEK - Firefox ESR 68.2 [NS/AOS/uBO] - Thunderbird 68.2.2 [EM] - ACP/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2681
  • Volunteer
Re: Site Blocked - URL:Phishing
« Reply #422 on: October 18, 2019, 04:04:57 PM »
Well said Michael..!! :) 8)

Ay, cheers! (Asyn is another one of the top helpers around here, Omega). Makes me look like small game :P)

@Omega5; Your domain has been whitelisted. Stay safe out there.

Hello,
if you mean the "omegacomputerservices.ca" it was unblocked today, 09:38 CET

Milos
*Volunteer*.
Tier I SOC Analyst; Threat Hunter; Digital Forensics (no cert); HTB Competitor; Pentester (no cert).

4th Year BCS Student @ The University of New Brunswick.

Offline lbeslay

  • Newbie
  • *
  • Posts: 1
Re: Site Blocked - URL:Phishing
« Reply #423 on: October 21, 2019, 09:32:01 AM »
Hy,

i have a Website hacked, but i deleted everything, did a new one, everything is clean; Google reviewed the url, but i'm still blacklisted in Avast and McAfee ...

Please can you whitelist it ?

this is the url:

www.mmeruetabaga.org

thank you.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 61524
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Win 8.1 [x64] - Avast PremSec 19.9.2394.B1 - CC 5.63 - EEK - Firefox ESR 68.2 [NS/AOS/uBO] - Thunderbird 68.2.2 [EM] - ACP/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline jefferson sant

  • Starting Graphoman
  • *
  • Posts: 6399
  • volunteer
Re: Site Blocked - URL:Phishing
« Reply #425 on: October 23, 2019, 02:31:31 AM »
Hy,

i have a Website hacked, but i deleted everything, did a new one, everything is clean; Google reviewed the url, but i'm still blacklisted in Avast and McAfee ...

Please can you whitelist it ?

this is the url:

wxw.mmeruetabaga.org

thank you.

Detection was removed in 22.10.2019 at 03:59 AM.

Quote from: Avast
Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

Offline Danielle11

  • Newbie
  • *
  • Posts: 11
Re: Site Blocked - URL:Phishing
« Reply #426 on: October 25, 2019, 09:14:08 PM »
I think I have a similar problem trying to login Shoppers' Drug Mart. 
The address is https://accounts.pcid.ca/login

I called Shoppers and they say their site is secured and that there are no problems reported.


Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2681
  • Volunteer
Re: Site Blocked - URL:Phishing
« Reply #427 on: October 25, 2019, 09:35:04 PM »
PC Optimum is owned by Loblaws (who also own Shoppers, Super Store etc).

Do you get the warning on the PC Optimum website? >> https://www.pcoptimum.ca/login
*Volunteer*.
Tier I SOC Analyst; Threat Hunter; Digital Forensics (no cert); HTB Competitor; Pentester (no cert).

4th Year BCS Student @ The University of New Brunswick.

Offline Danielle11

  • Newbie
  • *
  • Posts: 11
Re: Site Blocked - URL:Phishing
« Reply #428 on: October 25, 2019, 09:42:39 PM »
Ohhh …. I can login using https://www.pcoptimum.ca/login !
I will change my settings

Many many many thanks !



Offline Winglio

  • Newbie
  • *
  • Posts: 1
Re: Site Blocked - URL:Phishing
« Reply #429 on: October 26, 2019, 09:29:39 PM »
Hi, could you please unblock https://office.winglio.com/

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 61524
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Site Blocked - URL:Phishing
« Reply #430 on: October 26, 2019, 10:07:26 PM »
You can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php
Win 8.1 [x64] - Avast PremSec 19.9.2394.B1 - CC 5.63 - EEK - Firefox ESR 68.2 [NS/AOS/uBO] - Thunderbird 68.2.2 [EM] - ACP/ASL.BC
Deutschsprachiger Bereich -> Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline jefferson sant

  • Starting Graphoman
  • *
  • Posts: 6399
  • volunteer
Re: Site Blocked - URL:Phishing
« Reply #431 on: October 28, 2019, 10:04:02 PM »
Hi, could you please unblock hxtps://office.winglio.com/

Detection was removed in 28.10.2019 at 11:00 AM

Quote from: Avast
Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

Offline

  • Newbie
  • *
  • Posts: 1
Re: Site Blocked - URL:Phishing
« Reply #432 on: October 30, 2019, 02:42:09 AM »
Hi, my site https://pyramid-1491.com/ is being detected as url:phishing by avast. Can you help to unblock the site?

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31857
  • malware fighter
Re: Site Blocked - URL:Phishing
« Reply #433 on: October 30, 2019, 06:10:02 AM »
Hi 皓,

Probably some issue with the proxy VPN server at Linode's at 172.105.195.170

Wait for a final verdict from an avast team member, we have relative knowledge but only avast team members can come and unblock.  Website seems to have a good web rep and no detection at Virus Total at the moment.
Request returned: 您的请求在Web服务器中没有找到对应的站点!(not finding corresponding site!).

See issues: https://www.shodan.io/host/172.105.195.170

polonus
« Last Edit: October 30, 2019, 06:28:24 AM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31857
  • malware fighter
Re: Site Blocked - URL:Phishing
« Reply #434 on: October 30, 2019, 01:10:00 PM »
This is the content code I get
Quote
Content that was returned by your request for the URL: https://pyramid-1491.com/
also see: https://www.virustotal.com/gui/url/b0d3988efc7914ac6d3391354f8e716fdc01045af9913c89def2c2bb953a545e/detection

1:  < html>
2:  < head> < title> 502 Bad Gateway< /title> < /head>
3:  < body>
4:  < center> < h1> 502 Bad Gateway< /h1> < /center>
5:  < hr> < center> nginx< /center>
6:  < /body>
7:  < /html> Content after the < /html> tag should be considered suspicious.

8:  < !-- a padding to disable MSIE and Chrome friendly error page -->
9:  < !-- a padding to disable MSIE and Chrome friendly error page -->
10:  < !-- a padding to disable MSIE and Chrome friendly error page -->
11:  < !-- a padding to disable MSIE and Chrome friendly error page -->
12:  < !-- a padding to disable MSIE and Chrome friendly error page -->
13:  < !-- a padding to disable MSIE and Chrome friendly error page -->
IP = 34.80.130.210 Google Cloud address returned
Quote
Header returned by request for: https://pyramid-1491.com/ -> 34.80.130.210

HTTP/2 502
server: nginx
date: Wed, 30 Oct 2019 12:05:48 GMT
content-type: text/html
content-length: 552

polonus
« Last Edit: October 30, 2019, 01:17:03 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!