Site Blocked - URL:Phishing

[lukacsrob]

Avast antivirus threat is reported at https://ecl.hu/.  The website is ours, we removed the hacking attempt last month and it is now secure, but it still indicates a threat. We would like to request a solution to the problem.

[Asyn]

-> https://sitecheck.sucuri.net/results/https/ecl.hu
-> https://www.virustotal.com/gui/url/d1ded644b3175484da7c2fbf8c0a9d928b4b69c2140038a8fa2b9e96333ba5bd?nocache=1

[lukacsrob]

Avast is still reporting a virus, please remove it from the database. Virustotal.com still says that G-Data is reporting a virus, but G-data has already told us that:
The submitted URL is currently not blocked by our software anymore.

[Pondus]

Virustotal.com still says that G-Data is reporting a virus,

No it is not ... always refresh for a fresh result


https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

[polonus]

The website has various security issues, that should be tackled a.s.a.p.
Word Press CMS version is outdated: 4.9.19

User enumeration is left as enabled for user, download-directory listing has been left as enabled.

The following plugins were detected by reading the HTML source of the WordPress sites front page.

Plugin   Update Status   About
contact-form-7 5.0.5   Warning   latest release (5.5.6)
https://contactform7.com/
supportcandy 1.1.4   Warning   latest release (2.3.0)
https://wordpress.org/plugins/supportcandy/
event-geek 2.5.2    Unknown   
Plugins are a source of many security vulnerabilities within WordPress installations, always keep them updated to the latest version available and check the developers plugin page for information about security related updates and fixes.

There are likely more plugins installed than those listed here as the detection method used here is passive. While these results give an indication of the status of plugin updates, a more comprehensive assessment should be undertaken by brute forcing the plugin paths  using a dedicated tool.

Here the website has been qualified as potentially suspicious and has blacklisted links: https://quttera.com/detailed_report/ecl.hu

Libraries to be retired:

bootstrap   3.3.7   Found in -https://ecl.hu/wp-content/themes/graphene/bootstrap/js/bootstrap.min.js?ver=2018.09.01 _____Vulnerability info:
Medium   28236 XSS in data-template, data-content and data-title properties of tooltip/popover CVE-2019-8331   
Medium   20184 XSS in data-target property of scrollspy CVE-2018-14041   
Medium   20184 XSS in collapse data-parent attribute CVE-2018-14040   
Medium   20184 XSS in data-container property of tooltip CVE-2018-14042   
Medium   XSS is possible in the data-target attribute. CVE-2016-10735   
jquery   1.12.4   Found in -https://ecl.hu/wp-includes/js/jquery/jquery.js?ver=1.12.4 _____Vulnerability info:
Medium   2432 3rd party CORS request may execute CVE-2015-9251   1234
Medium   CVE-2015-9251 11974 parseHTML() executes scripts in event handlers   
Medium   CVE-2019-11358 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution   
Medium   CVE-2020-11022 Regex in its jQuery.htmlPrefilter sometimes may introduce XSS   1
Medium   CVE-2020-11023 Regex in its jQuery.htmlPrefilter sometimes may introduce XSS   1

polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)

[thao_legend]

I hope avast considers removing the phishing warning from the website : energized.pro
this is just a website that provides a filter to block ads on the browser, no problem at all
thanks

[bob3160]

I hope avast considers removing the phishing warning from the website : energized.pro
this is just a website that provides a filter to block ads on the browser, no problem at all
thanks

Follow the advice offered here:
https://forum.avast.com/index.php?topic=218384.msg1676256#msg1676256

[polonus]

What is being pinged from this website?
-energized.pro, -watchdog.energized.pro, -browser.net, -(maxt)icons8.com, -opencollective.com,
-paypalobjects.com, -shields.io, -img.shield.io
Site also has raw http headers. Site does not have cloaking, different status codes, spammy looking links, iframes, and is not being blacklisted.

Follow bob3160's advice.
Then wait for a final verdict from avast team.
This as they are the only ones to come and unblock.

We here are just volunteers with relative knowledge.

polonus

[charles.jaw]

Our website(hxtps://headlineforce.com) had been hacking last month, and we already fixed it. But it still repored as a threat. Can you help unlock the website?

[Asyn]

-> https://sitecheck.sucuri.net/results/https/headlineforce.com
-> https://www.virustotal.com/gui/url/cc2e56d2030c394d0036dd68cf207967c4b15d0c746e802b21e34a893c6ac1c7?nocache=1

[pascal.luescher]

Hello our site hxtps://my.bpw.ch is blocked for phishing but we have no idea why.
both sitecheck and wirustotal show no malware. can you unblock it please?

[Asyn]

Hi, you can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php

[polonus]

Only external link that could have come blocked is to -cdn.jsdelivr.net
No particulars here:
https://quttera.com/detailed_report/my.bpw.ch  * https://www.shodan.io/host/51.103.140.125

Wait for a final verdict from avast team, as they are the only ones to come and unblock.
We here are just volunteers with relative knowledge,

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

[paolorossi15]

Hello, please forgive me for the inconvenience.
Unfortunately, the access by users to the eurekaddl.bid site is blocked due to the presence of URL: TechScan
I believe it may be a false positive because I have tried all the Wordpress security plugins and none of them have found such a threat:
https://i.postimg.cc/C1QPPcMD/Screenshot-1.png
Also, I tried to scan it with Virustototal and it doesn't detect any threats:
https://www.virustotal.com/gui/url/adff3abba0d1d394b57a50dc01873a39c10322bda6435a6cfcbd5e625fbf7c13?nocache=1
Same thing for Google Safe Browsing:
https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Feurekaddl.bid
Please help me solve this problem.
Thanks for your kindness and understanding, best regards

[DavidR]

Use the link posted in Reply #731 (quoted below) to report it.

Hi, you can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php