Author Topic: False positive site blacklisted as phishing  (Read 9631 times)

0 Members and 1 Guest are viewing this topic.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: False positive site blacklisted as phishing
« Reply #30 on: September 26, 2018, 11:02:41 AM »
Also we have many automatic unblocking systems, but as your domain only had a couple of visitors during the weekend, it was not even considered (certain traffic is needed to enter the algorithm).
Interesting, thanks Honza, good to know.
Just to be clear - we have a couple of automatic unblocking systems, but the one that could unblock this particular domain needed bigger traffic.
OK, roger that. Cheers
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

REDACTED

  • Guest
Re: False positive site blacklisted as phishing
« Reply #31 on: September 26, 2018, 02:47:50 PM »
@HonzaZ, thanks for your answer.

My original question was with the purpose of understanding why the content we served was deemed malicious and how to prevent it in the future (best-practices).

We were certainly not serving malicious content, since it was only testing htmls and images.

Is there any kind of information you can share about this?

Thanks again

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1038
Re: False positive site blacklisted as phishing
« Reply #32 on: September 27, 2018, 10:47:29 AM »
Hi,
what I was trying to say (apparently unsuccessfully) was that there are many independent algorithms which block URLs based on many factors. Even if I told you each algorithm in detail (which would take at least a two day seminar), it can be changed in the future anyway, so there is no incentive to do that.
Just as polonus said, the best way to avoid detection is to "behave normally", have no vulnerabilities, serve no malicious code etc. But even then there can be false positives.