False Positive: Site Blocked - URL:Phishing

[Bogdan Schimbischi]

@DavidR thank you for reply.

I've report it about 40 minutes ago.

Who will cover the cost of losses for this ?

[DavidR]

As an Avast User, I have no input on this.

[polonus]

Hi Schimbischi,

Good news as avast online does no longer flag this website.

However there are some...
Issues to look into: as retirable code was found on that website:

bootstrap   3.3.4   Found in
-https://www.companisto.com/code/bootstrap/dist/js/bootstrap.min.js _____Vulnerability info:
Medium   28236 XSS in data-template, data-content and data-title properties of tooltip/popover CVE-2019-8331   
Medium   20184 XSS in data-target property of scrollspy CVE-2018-14041   
Medium   20184 XSS in collapse data-parent attribute CVE-2018-14040   
Medium   20184 XSS in data-container property of tooltip CVE-2018-14042   
Medium   XSS is possible in the data-target attribute. CVE-2016-10735   
jquery   1.11.2.min   Found in
-https://cdn.companisto.com/code/scripts/jquery-1.11.2.min.js _____Vulnerability info:
Medium   2432 3rd party CORS request may execute CVE-2015-9251   
Medium   CVE-2015-9251 11974 parseHTML() executes scripts in event handlers   
Medium   CVE-2019-11358 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution   
Medium   CVE-2020-11022 Regex in its jQuery.htmlPrefilter sometimes may introduce XSS   
Medium   CVE-2020-11023 Regex in its jQuery.htmlPrefilter sometimes may introduce XSS   

Files not found as blocked by browser: File not found:
-https://bat.bing.com/bat.js

File not found: -https://www.googletagmanager.com/gtm.js?id=GTM-KHVZHHS

File not found: -https://www.googletagmanager.com/gtm.js?id=GTM-PC9BJK

File not found: -https://cdn.scarabresearch.com/js/1CEA86B5EC4A5E84/scarab-v2.js

Tracker SSL warns:

Website is insecure by default
100% of the trackers on this site could be protecting you from NSA snooping. Tell
-companisto.com to fix it.

Identifiers | All Trackers
 Insecure Identifiers
Unique IDs about your web browsing habits have been insecurely sent to third parties.

-companisto_6325ea5d4a274 wXw.companisto.comctx_id
Legend

 Tracking IDs could be sent safely if this site was secure.

 Tracking IDs do not support secure transmission.

polonus (volunteer 3rd party cold reconnaissance website security analyst and website error-hunter)

[Volkv]

Hello. Can you please check why https://cq.ru is blocked with URL:phishing error. Thanks!

[DavidR]

Hello. Can you please check why cq.ru is blocked with URL:phishing error. Thanks!

Please break active link (as I have in the quote) to avoid accidental exposure.
See https://www.virustotal.com/gui/url/ebca93c04b2dd41d52eb955563d5a225a6b79bace30427b5609c40a0dac5277f only one there.
Nothing here - https://sitecheck.sucuri.net/results/cq.ru

Also see - https://en.internet.nl/site/cq.ru/1733507/

Also - Webpage Security Score F - https://snyk.io/test/website-scanner/?test=221011_AiDcJN_7MH&utm_medium=referral&utm_source=webpagetest&utm_campaign=website-scanner - these weaknesses could make it more liable to abuse.

[Wira]

Can Someone Check why my URL Got Block

https://www.virustotal.com/gui/url/572c979486184e7ce8069963c9f5aadfdeccb1308e9aff3c110a666886969de2?nocache=1

https://sitecheck.sucuri.net/results/mail.zap.co.id

https://snyk.io/test/website-scanner/?test=230110_AiDcNN_7CV&utm_medium=referral&utm_source=webpagetest&utm_campaign=website-scanner

https://en.internet.nl/site/mail.zap.co.id/1865150/

[DavidR]

You can use the - Reporting a Possible False Positive File or Website - https://www.avast.com/false-positive-file-form.php.
You should get a response in a day or two.

[polonus]

Hi Wira,

VT gives it as clean. Could have been the http/https redirect, the Bitdefender p*rn alert,
or an issue with the zimbra redirect found.

Just wait for a final verdict by avast team.

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

[Francesco35]

Our website (https://www.erasmustrainingcourses.com)  is blocked since more than 2 weeks. We've reported at https://www.avast.com/false-positive-file-form.php already since more than 2 weeks and we've reported again today. We had to disinstall Avast from all our devices but still many customers cannot access. We're very upset, please fix this problem as soon as possible

[DavidR]

Our website (erasmustrainingcourses.com)  is blocked since more than 2 weeks. We've reported at https://www.avast.com/false-positive-file-form.php already since more than 2 weeks and we've reported again today. We had to disinstall Avast from all our devices but still many customers cannot access. We're very upset, please fix this problem as soon as possible

Please break the active link in your post (as I have in the quoted text) or change the https to hXXps:// to avoid accidental exposure.
You should have had an email response on your submission.

That said - nothing found on this check - https://www.virustotal.com/gui/url/98c421809c64c6806df31620d61a030478692c35fbd71b041ffb87d4ded36e55?nocache=1
However there are external links on your site which could be the reason - this one in particular - hXXps://drive.google.com/open?id=XXXXXXX  and hXXps://drive.google.com/file/d/1-XXXXXXX not sure why these would be needed or if they could be the reason.

There are security notifications reported in this check - https://en.internet.nl/site/erasmustrainingcourses.com/2074409/
Low risk, but some recommendations reported here - https://sitecheck.sucuri.net/results/erasmustrainingcourses.com
Considered benign here - https://zulu.zscaler.com/submission/ca16121f-23de-4b76-aa9d-c5db9f4c4d7d

Note I'm an Avast user and not employed by Avast.

[polonus]

As DavidR says, no direct flags elsewhere, so wait for a final verdict from avast team.

But consider: https://www.shodan.io/domain/cmp.osano.com (one of the javascript finds there).

See website's hardening proposals: https://sitecheck.sucuri.net/results/www.erasmustrainingcourses.com

polonus

[Jeffrey S]

The Avast software is saying that www.google.com.mcas.ms is infected with URL: Phishing.

I currently have 4364 instances of this notification. The Avast popup is constant and interrupts productivity. I have scanned the PC numerous times to no avail. HELP!

Best regards,

Jeffrey

[bob3160]

The Avast software is saying that xxx .google.com.mcas.ms is infected with URL: Phishing.

I currently have 4364 instances of this notification. The Avast popup is constant and interrupts productivity. I have scanned the PC numerous times to no avail. HELP!

Best regards,

Jeffrey

Please do not post live suspected links in the forum. Follow the instructions already posted in this thread.

[polonus]

Hi Jeffrey S,

Bob3160 is right here, on the site report by Netcraft that link has a 7 out of 10 risk status.

See: https://urlscan.io/ip/40.81.121.140  on this OpenResty Server ->
https://vulmon.com/searchpage?q=openresty

Consider -http://mcasproxy.azureedge.net/proxyweb/1.33.32/js/session-context-store-helper.min.js
and https://urlscan.io/result/755b3a08-b4ff-4e64-9273-f986814c5906/

Wait for a final on this from avast team,

polonus

[StreamHD]

Avast multiple times false detect my website streamhd247.info. It happens after every 4 to 5 days. I have no extrenal links on my website just a pop-up from popular ad network. I report false detect to avast and they clear in a day or two but it affect my traffic. Kindly resolve this issue permanently.

Thank You