Author Topic: Avast Falsely blocking my URL as Phishing threat  (Read 1192 times)

0 Members and 1 Guest are viewing this topic.

Offline Derek125

  • Newbie
  • *
  • Posts: 2
Avast Falsely blocking my URL as Phishing threat
« on: April 09, 2021, 05:49:15 AM »
Hello,

My URL, Saber(.)com, has has not been resolving on my home network computers. I figured it was because I recently updated my Name Servers to point to Wix, a website development software, and that it would take a few days to propagate before resolving. It has been a week, and still does not resolve on my desktop. Tonight I noticed that my Avast had over 30 threat notifications, and when I clicked on it, saw that it was blocking the URL from opening on my computer! It reported that it was a Phishing URL, which it absolutely is not!

How can we get this quickly resolved so that it isn't blocking valuable traffic? Thank you.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast Falsely blocking my URL as Phishing threat
« Reply #1 on: April 09, 2021, 07:10:19 AM »
You can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33897
  • malware fighter
Re: Avast Falsely blocking my URL as Phishing threat
« Reply #2 on: April 09, 2021, 10:01:30 AM »
Howdy Derek125,

Nice to skim over the security status of one of the oldest websites of the Interwebz.
Looks great to me. Resolves over https all right, but no response over http
(may be that is because of that particular hick-up).

Checked for inline: Javascript 36   (external 14, inline 22)
-browser.sentry-cdn.com/5.21.4/​bundle.min.js (blocked for me by UMatrix because of ||browser dot sentry-cdn dot com^)
easy filter.
INJECTED

-static.parastorage.com/unpkg/core-js-bundle@3.2.1/​minified.js
-static.parastorage.com/unpkg/focus-within-polyfill@5.0.9/dist/​focus-within-polyfill.js
-polyfill.io/v3/​polyfill.min.js?features=fetch

We see a lot of distinct discrepancies with CloudFlare handling:
-htXps://d3uvwl4wtkgzo1.cloudfront.net/e8af8301-45e2-41c6-9212-9421ce1b1dc7.js 

Take that one up with CloudFlare's for I point at e.g. Amazon's PotPlayer set-ups being flagged & other executables.

Excessive server info proliferation: https://ns.tools/saber.com = Pepyaka+1.15.10 (do not make it speak that loud);
Well a good A-status, website well-configured. ;)

Re: https://www.shodan.io/host/185.230.60.177 (no vulnerabilities given). ;)
No DOM-XSS issues from DOM-XSS base finder.

Probably IP-related: https://www.virustotal.com/gui/ip-address/185.230.60.177/relations

Wait for a final verdict from Avast Team. It is their definitions and they are the ones to come and unblock in case of an FP.
That may be well over the week-end. Have a good week, Sir.

polonus (volunteer 3rd party cold recon website security-analyst and website error-hunter)
« Last Edit: April 09, 2021, 10:08:14 AM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Derek125

  • Newbie
  • *
  • Posts: 2
Re: Avast Falsely blocking my URL as Phishing threat
« Reply #3 on: April 09, 2021, 01:33:35 PM »
Thank you both for the reply!

Polonus: Thanks for looking into this and the detailed reply. I'm not very technical, so I can't elaborate much on the info below. But from what I gather, you're saying the site mostly looks good? I'm not sure why the http is not responding, but I did change the DNS to Wix, and hoped everything would sort out ok. As far as I know I am not using Cloudflare?

I guess at this point I should just wait until there's a verdict? thanks again for taking a look.