Site Blocked - URL:Phishing

[Pondus]

I need to know why Avast is blocking as phishing

Then report it as said in my post above, you should then recive a mail from avast lab

in case it was difficult to see, here it is again


Report a suspected false positive (select file or website)


Click this link >>  https://www.avast.com/false-positive-file-form.php

[seeraig]

Probably this link could be flagged:  -https://cdn.userway.org/widget.js
Besides we discovered an alert that your connection is not secure (see *)

I removed the userway link, also made whole site default to https via URL rewrite in IIS. still gets blocked. Avast does not block on https, only http. but I don't understand because I did the URL rewrite to https, so it automatically defaults all url's to https. Yet if you type http, avast still blocks it.

This still does not seem to be the issue. There are many sites that default to only http, yet they are not marked as phishing, having a non-secure homepage when no security details are collected is not insecure or not phishing, besides that is not the case now anyways.

[seeraig]

I need to know why Avast is blocking as phishing

Then report it as said in my post above, you should then recive a mail from avast lab

in case it was difficult to see, here it is again


Report a suspected false positive (select file or website)


Click this link >>  https://www.avast.com/false-positive-file-form.php

I already did over 24 hrs ago, no response.

[Pondus]

I already did over 24 hrs ago, no response.

be patient, workload, corona time .................

[usalabs14]

I have the same problem with songtr.ee

The site is a musicians collaborations site, and I've never had any problems with it, until the last Avast update, Avast says the connection was blocked because of URL:Phishing I even tried to add it to the Avast exception list and it's still blocked, the desktop client that connects to that site is also blocked for the same reason.

According to immuniweb I did a 45 second phishing test and it was found to be clean, therefore, the only assumption is that the domain triggered a false positive in Avast.

[Asyn]

-> https://sitecheck.sucuri.net/results/songtr.ee

[seeraig]

****** UPDATE ****** We've been cleared from their system now. For others, i guess it can take over 72hrs for them to respond to your false positive requests through the form on their website.


It's now been over 72 hours since I reported a false positive through their website form. How long does it take for them to respond? It's quite egregious to just frivolously block legitimate sites and then not respond to requests. They are the only antivirus that is blocking us, we come up clean everywhere and I know we are not phishing in any way.

[polonus]

Hi seeraig,

We all have to wait here for a final verdict from an avast team member,
as they are the only ones to come and unblock.
We here are just volunteers with relative knowledge.

Some additional points besides what you could grasp from above mentioned Sucuri report:

As stated there, there certainly are security issues with that website -
outdated CMS software - for instance weak PHP

There is an issue with status codes:
Google Chrome returned code 302 to -https://songtr.ee/home.php
GoogleBot returned code 302 to -https://songtr.ee/welcome.php

Retirable code: https://retire.insecurity.today/#!/scan/ab55f02a2591b3402be65711479b10abfd0bb4143beefca2cd4c05e871184dd8

48 recommendations (especially in the field of security (10)) see:
https://webhint.io/scanner/b9cc8998-5623-44bf-9763-fa4d187a0310

polonus (volunteer 3rd party cold recon website security analyst & website error-hunter)

[SystemCry]

hello avast support team, this warning appears on my okey game site. There is no such problem in other okey sites, only my site has a problem. My domain address is okeyciyiz.com blacklisted. Can you help me? The necessary cleaning of the site has been done. I haven't been able to solve this problem for 4 months. Can you remove my domain address, okeyciyiz.com, from the blacklist.
 image url , https://hizliresim.com/5kgrrk

[Pondus]

okeyciyiz.com  >>  https://sitecheck.sucuri.net/results/okeyciyiz.com


https://www.virustotal.com/gui/url/45c1aa18c67174171d605137448e449aba2c9191245719c036fa72e6ed49b3d9/detection





Report a suspected false positive (select file or website)


Click this link >>  https://www.avast.com/false-positive-file-form.php

[polonus]

VM12 sandbox_bundle.js:15 (electron) Security Warning: webFrame.executeJavaScript was called without worldSafeExecuteJavaScript enabled. This is considered unsafe. worldSafeExecuteJavaScript will be enabled by default in Electron 12.

polonus

[Sue98]

Hello, Team @Avast,

My website, Goranga.com (www.goranga.com) is blacklisted with avast. Any of our partners who have avast installed on their system are unable to access it. This is so wrong. We are a very secure & reputed business.

Please action this asap.

[Asyn]

-> https://sitecheck.sucuri.net/results/www.goranga.com
-> https://www.virustotal.com/gui/url/4b14115e44ff40e3417cbdc46856a675d8f40782b1571eea66902c0d8aa856b9/detection

You can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php

[polonus]

Wait whether this is not an FP or a genuine resource-axd-trojan detection.
The only ones to decide about this and then come and unblock are avast team members.
Wait for their final verdict.

polonus

[Hopper15]

I reported a URL in the link below.
https://www.avast.com/false-positive-file-form.php

I was just curious how long does it usually take to hear back anything.