URL: Blacklist notification

[7PCGamer]

Hi,

Trust you are doing well.
Just curious to know abt the URL: Blacklist notification, cud'nt find any documentation
.. is it some virus script codenamed "Blacklist"?

The msg popped when I was trying to access
https://www.locusinn.com/games/divinity/guides/DivinityQuestGuideV2.pdf
.. and it automatically terminates the connection.
Am using Avast Secure Browser latest version on a fully updated Win 7 HP x64.

I also checked the website profile on VirusTotal ... came out clean (snap attached)

Am getting similar messages frequently for 1st page results on Google.. anything wrong with my settings?

Thanks.

[Pondus]

Just curious to know abt the URL: Blacklist notification, cud'nt find any documentation
.. is it some virus script codenamed "Blacklist"?

Blacklist (computing)   
https://en.wikipedia.org/wiki/Blacklist_(computing)
https://en.wikipedia.org/wiki/Wikipedia:Spam_blacklist
https://en.wikipedia.org/wiki/Template:Blacklisted-links




You dont give any info / screenshot about what avast say so we have to guess .......

[7PCGamer]

Thanks for the revert.
It says "infected with URL:Blacklist"
Will soon update the full string of notification.
I dont have access to this specific computer right now..

[Pondus]

It says "infected with URL:Blacklist"

OK it seems avast may have changed a detection name? as i have not seen that before


It used to be:
URL:Mal = Blacklisted URL or IP
PDF:UrlMal-inf [Trj] = pdf.doc that containe link to a blacklisted URL


The infected with is just a general text that is on top of all messages even if it is not a infection

[7PCGamer]

Hi,
Heres the full string:
"Weve safely aborted connection on www.locusinn.com because it was infected with URL:Blacklist"

I am merely posing this as an example .. this kind of intervention has become somewhat frequent.
I have attached my web shield settings.. for soliciting recommendations.

Thanks.

 

[Pondus]

you can check suspicious URLs here:

File and URL (blacklist)  check  https://www.virustotal.com/
Website check  https://sitecheck.sucuri.net/


If you suscpect false positives then see my post here on how to report
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

[DavidR]

VirusTotal isn't very good for URL checking as it doesn't actually do a scan, but refers to blacklists. 

It is possible that the "infected with URL:Blacklist" could also be caused by an attempt to access a 3rd party URL from that site.

[mchain]

Sucuri also does blacklist checks but also checks for other things:  https://sitecheck.sucuri.net/results/https/www.locusinn.com

Seems [h]ttps://www.locusinn.com not configured correctly.  http://urlquery.net/report/74c504ba-1673-48d5-9732-b7def7da2389, i.e. insecure connection.

[Fabi12]

Hello, I've had the same problem for a long time, around half a year.
But, My url is not the same. My url is bbtbfr.pw
"We've safely abortd connection on bbtbfr.pw because it was infected with URL:Blackist.

[bob3160]

Hello, I've had the same problem for a long time, around half a year.
But, My url is not the same. My url is bbtbfr.pw
"We've safely abortd connection on bbtbfr.pw because it was infected with URL:Blackist.

Report a false positive (select file or website)
https://www.avast.com/false-positive-file-form.php

[Asyn]

-> https://sitecheck.sucuri.net/results/bbtbfr.pw

[jefferson sant]

Hi,
Heres the full string:
"Weve safely aborted connection on wxw.locusinn.com because it was infected with URL:Blacklist"

I am merely posing this as an example .. this kind of intervention has become somewhat frequent.
I have attached my web shield settings.. for soliciting recommendations.

Thanks.

Detection was removed in 26.02.2020 at 06:21 AM

Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

[jefferson sant]

Hello, I've had the same problem for a long time, around half a year.
But, My url is not the same. My url is bbtbfr.pw
"We've safely abortd connection on bbtbfr.pw because it was infected with URL:Blackist.

It is not a false positive. 

Our virus specialists have been working on this problem and they informed me that this detection is correct. This is most likely caused by a browser hijacker.

[begalund]

It is nice that this isn't a false positive, but avast isn't removing the threat completely, it just keeps jumping and then reappearing.  I've had it pop up about 30-35 times today (at least) even though I get the "threat secured" message, it will just reappear 5-10 minutes later.  I don't have my web browser open, it just pops back up. 

I'd love to just kill it and not worry about it, rather than have the harsh warning dings every 10 minutes warning me about the threat - even when I'm not using the machine, it's just sitting idle.

[DavidR]

It is nice that this isn't a false positive, but avast isn't removing the threat completely, it just keeps jumping and then reappearing.  I've had it pop up about 30-35 times today (at least) even though I get the "threat secured" message, it will just reappear 5-10 minutes later.  I don't have my web browser open, it just pops back up. 

I'd love to just kill it and not worry about it, rather than have the harsh warning dings every 10 minutes warning me about the threat - even when I'm not using the machine, it's just sitting idle.

Well it looks like you could have an underlying problem (but without details, tough to suggest anything), something is trying to connect to something considered a blacklisted URL and avast is preventing the connection to that URL.  What the problem is finding what is trying to make that connection.

Attaching a screenshot of the avast alert window might help and opening the See Details option may indicate what was trying to make that connection.

Without details we just can't say what the cause is. 
It may well be best to start your own new topic on this (possibly in the viruses and worms sub-forum) and we will try to help.