Author Topic: avast keeps scanning my site  (Read 3565 times)

0 Members and 1 Guest are viewing this topic.

Offline thexkey

  • Amateur Web Developer
  • Newbie
  • *
  • Posts: 7
  • Amateur Web Developer
avast keeps scanning my site
« on: April 22, 2021, 09:31:19 PM »
hello all,

i have a website where AVAST's servers keep scanning for wordpress so much it is causing the site to slow down a bit, and fill up the error/access logs.

i do not have wordpress installed at all since it is bad (vulnerable and CPU intensive)

how can i tell the AVAST servers to scan less?
i dont even have avast installed in any of my devices so i have no idea how avast found my site (i use ESET)

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: avast keeps scanning my site
« Reply #1 on: April 22, 2021, 09:38:58 PM »
How do you know this ?

Avast doesn't go looking for your site/s, it is a client based scanned that scans web sites (using the Web Shield) when visited by an avast user/s. 
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline thexkey

  • Amateur Web Developer
  • Newbie
  • *
  • Posts: 7
  • Amateur Web Developer
Re: avast keeps scanning my site
« Reply #2 on: April 22, 2021, 09:57:15 PM »
How do you know this ?

Avast doesn't go looking for your site/s, it is a client based scanned that scans web sites (using the Web Shield) when visited by an avast user/s. 

i ran a IP lookup on the IP on the website's logs and it said it belonged  to "AVAST Software s.r.o."

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: avast keeps scanning my site
« Reply #3 on: April 23, 2021, 12:38:46 AM »
Given what you see under Services: Network sharing device or proxy server.  I just wonder if it isn't related to avasts SecureLine VPN product.

So it could be a user (of that SecureLine VPN product) rather than Avast in itself.  However as an Avast User and non user of the SecureLine VPN product I can't say that with certainty.  But if that is the case I can't see how that would differ from a regular visitor.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline thexkey

  • Amateur Web Developer
  • Newbie
  • *
  • Posts: 7
  • Amateur Web Developer
Re: avast keeps scanning my site
« Reply #4 on: April 23, 2021, 01:39:39 AM »
Given what you see under Services: Network sharing device or proxy server.  I just wonder if it isn't related to avasts SecureLine VPN product.

So it could be a user (of that SecureLine VPN product) rather than Avast in itself.  However as an Avast User and non user of the SecureLine VPN product I can't say that with certainty.  But if that is the case I can't see how that would differ from a regular visitor.

how would i block/detect if they are using the Avast VPN?
i do not want the site to be flooded with wordpress requests (i dont even have wordpress so it just 404's)

EDIT: that message means it could be a proxy or a shared connection (ie a business/location having tons of computers connected to 1 IP address.)
EDIT 2: also they were making a crap-ton of requests to various directories looking for a XML file in wordpress related folders.
« Last Edit: April 23, 2021, 02:07:26 AM by thexkey »

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: avast keeps scanning my site
« Reply #5 on: April 23, 2021, 02:59:40 AM »
As I said, I'm an avast user so can't offer any advice in that regard.

I have reported this topic in the hope of drawing some avast input.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline thexkey

  • Amateur Web Developer
  • Newbie
  • *
  • Posts: 7
  • Amateur Web Developer
Re: avast keeps scanning my site
« Reply #6 on: April 23, 2021, 06:23:11 PM »
I have reported this topic in the hope of drawing some avast input.

thanks

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: avast keeps scanning my site
« Reply #7 on: April 23, 2021, 08:02:17 PM »
You're welcome, lets hope it brings some clarification.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline thexkey

  • Amateur Web Developer
  • Newbie
  • *
  • Posts: 7
  • Amateur Web Developer
Re: avast keeps scanning my site
« Reply #8 on: April 24, 2021, 05:56:11 AM »
bump, same IP is still doing requests for wordpress related things.....

Offline r@vast

  • Avast team
  • Massive Poster
  • *
  • Posts: 2761
Re: avast keeps scanning my site
« Reply #9 on: April 28, 2021, 12:07:17 PM »
How do you know this ?

Avast doesn't go looking for your site/s, it is a client based scanned that scans web sites (using the Web Shield) when visited by an avast user/s. 

i ran a IP lookup on the IP on the website's logs and it said it belonged  to "AVAST Software s.r.o."


Hi,

Can you please provide me with the IP address?

Offline thexkey

  • Amateur Web Developer
  • Newbie
  • *
  • Posts: 7
  • Amateur Web Developer
Re: avast keeps scanning my site
« Reply #10 on: April 29, 2021, 02:30:19 AM »

here is the ip: 159.242.234.127
there were 2 other IP's but i did not save those and the logs were auto-cleared when i checked today.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: avast keeps scanning my site
« Reply #11 on: April 29, 2021, 11:21:46 AM »
This IP is one of the top ten blocked yesterday,
according to this list here: https://8thdomaintechnology.com/abusive-ips-february-28-2021/
-159.242.234.127     Germany                        block count: 17  suspected of spamming...

So wait for a final verdict from an avast team member, as they are the only ones eventually to come and unblock.

Decimal: 2683497087

Hostname: 159.242.234.127

ASN: 198605

ISP: AVAST Software s.r.o.

Organization: AVAST Software s.r.o.

Services: Network sharing device or proxy server
Recently reported forum spam source. (8)

Type: Corporate

Assignment: Likely Static IP

Continent: Europe

Country: Germany

State/Region: Hesse

City: Frankfurt am Main

polonus

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline r@vast

  • Avast team
  • Massive Poster
  • *
  • Posts: 2761
Re: avast keeps scanning my site
« Reply #12 on: April 29, 2021, 03:47:35 PM »

here is the ip: 159.242.234.127
there were 2 other IP's but i did not save those and the logs were auto-cleared when i checked today.

Hi,

The IP 159.242.234.127 belongs to our VPN service.
This means that someone used our VPN service to access your website.

Offline thexkey

  • Amateur Web Developer
  • Newbie
  • *
  • Posts: 7
  • Amateur Web Developer
Re: avast keeps scanning my site
« Reply #13 on: April 30, 2021, 05:06:37 AM »

here is the ip: 159.242.234.127
there were 2 other IP's but i did not save those and the logs were auto-cleared when i checked today.

Hi,

The IP 159.242.234.127 belongs to our VPN service.
This means that someone used our VPN service to access your website.

how do i block all of the VPN IP addresses?

Offline r@vast

  • Avast team
  • Massive Poster
  • *
  • Posts: 2761
Re: avast keeps scanning my site
« Reply #14 on: April 30, 2021, 02:01:19 PM »

how do i block all of the VPN IP addresses?

Hi,

This is, unfortunately, not something we can assist you with.
Please consider contacting your hosting provider for advice.