Author Topic: False Positive: Site Blocked - URL:Phishing  (Read 3358 times)

0 Members and 1 Guest are viewing this topic.

Offline DevonBrown

  • Newbie
  • *
  • Posts: 5
False Positive: Site Blocked - URL:Phishing
« on: September 30, 2020, 09:58:08 PM »

Not sure I'm posting the right area, but the avast software is saying that our company domain easy.12minuteaffiliate.com/home is blocked because of phishing URL.

This has caused huge concerns among our customers who had your software on their laptops. Can we understand what happened here and what had triggered the false positive??

https://www.screencast.com/t/drCECEGG

Thank you in advance for clarification.

I've already submitted my url to the "report suspected false positive" site you have - so far, no response

Kind regards
Devon

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: False Positive: Site Blocked - URL:Phishing
« Reply #1 on: September 30, 2020, 10:25:45 PM »
Do not see that site actually being blocked now,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DevonBrown

  • Newbie
  • *
  • Posts: 5
Re: False Positive: Site Blocked - URL:Phishing
« Reply #2 on: October 01, 2020, 01:02:20 AM »
so, I just removed the url from my list of my site exceptions (in avast)-
and it's still doing the same thing (still blocking the site)


Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88899
  • No support PMs thanks
Re: False Positive: Site Blocked - URL:Phishing
« Reply #3 on: October 01, 2020, 03:15:35 AM »
It's still detected, trying to connect to the main domain redirects to easy.12minuteaffiliate.com/home, so I don't know if this might have something to do with it.

Have you actually reported it here - Reporting Possible False Positive File or Website - https://www.avast.com/false-positive-file-form.php.  This goes directly to the avast virus labs team.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline DevonBrown

  • Newbie
  • *
  • Posts: 5
Re: False Positive: Site Blocked - URL:Phishing
« Reply #4 on: October 01, 2020, 04:06:07 AM »
DavidR

Thanks for your reply and the screen-shot

Yeah - it's still being blocked on my end too.

The redirect has been like that for years (it's the way it's supposed to work)

I've had my tech team look and they can't find anything malicious on the site.
We've dropped the url into multiple "site checkers" and it always comes back clean.
And, to the best of my knowledge, there have been no updates to the site since yesterday when this first happened.


I reported the false positive multiple times today (haven't heard anything back)


Thanks
 - Devon


Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88899
  • No support PMs thanks
Re: False Positive: Site Blocked - URL:Phishing
« Reply #5 on: October 01, 2020, 11:43:37 AM »
You're welcome, though I don't believe the response would be immediate.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: False Positive: Site Blocked - URL:Phishing
« Reply #6 on: October 01, 2020, 06:21:25 PM »
Hi Devon Brown,

I get a "Page not found" on Clickfunnels @ -https://easy.12minuteaffiliate.com/nopage_error.html for that matter.
Quote
No Page matching this path found.

If you were looking for ClickFunnels Sales Funnel Builder Click here (or Use -http://status.clickfunnels.com in stead).

If you believe this page should be here, there might be more information on our status page


In a similar thread in this here virus & worms section of the forums,
we have been met with a reaction by a Clickfunnels' representative,
who goes on about certain particular obfuscation in CloudFlare's anti-bot code,
to make that anti-bot solution more effective.

As to this moment we heard from avast team that the detection should be genuine,
let us all wait for a final word on the matter.

This knowing that other av-solutions have much worse track-records in the field of deny-listing staying on and on.

I am also curious as what finally will be established triggering the blocking of these sites.

polonus (volunteer 3rd party cold recon website security analyst and website error-hunter)

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DevonBrown

  • Newbie
  • *
  • Posts: 5
Re: False Positive: Site Blocked - URL:Phishing
« Reply #7 on: October 01, 2020, 09:29:52 PM »
Hey Polonus

The "page not found" error happened depending on which browser you were using

But the overall error (on my computer and on the computers of many of the people trying to go to my site) was because avast was blocking it.

It seems (at this point) that Avast has removed the block   (try going to easy.12minuteaffiliate.com/home )

But to your other points - I'm curious about what triggered this as well

I was in a clickfunnels forum and apparently there are a couple of other people who this happened to - I'm not technical but it may have something to do with cloudflare (I don't know)

As for now it seems that the avast virus specialists have now cleared the site's reputation in their database

But I would love to know what's triggering the issue in case it's happening elsewhere with other av solutions - I'd love to fix whatever happened (if I can)

If you have any insight, I'd love to hear it

Thanks
Devon






Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: False Positive: Site Blocked - URL:Phishing
« Reply #8 on: October 02, 2020, 01:07:05 PM »
Hi Devon,

I am curious as well "what cat will come creeping out of what bag at the end of the day" so to say.
Try to understand my position, I am just a volunteer here and not an avast team member,

I am a volunteer, that they offer a platform, because of my relative knowledge in the field
of 3rd party cold recon website security intelligence and website error hunting.

Seems that CloudFlare has added specific obfuscation to get rid of all the anti-anti-bot attacks,
they are constantly enduring and that somehow got in the cross-hairs with clickfunnels,
and caused a Cloaking detection for some websites
(Cloaking meaning Google is being shown a difference of code and code size.
seen in reference  to what is being shown to Googlebot).

What redirect exactly is involved I do not know, somehow it seems clickfunnel's or CloudFlare's doing,
or whether it is just the obfuscation used there, that is a no no to trigger avast to block.

So we have to be patient and wait and see where the issue goes eventually.

Damian a.k.a. polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DevonBrown

  • Newbie
  • *
  • Posts: 5
Re: False Positive: Site Blocked - URL:Phishing
« Reply #9 on: October 02, 2020, 04:55:38 PM »
Polonus


Ahhhh - gotcha.

I thought you worked for avast. I wasn't aware that you were a volunteer

I appreciate you taking the time to comment and share your insight :-)

Hopefully it's a clickfunnels/cloudflare issue that people (who know way more than me) are working on and are able to fix

Thanks