Anyone know why ftp.epson.com is blocked by url:blacklist

[jeff0000]

Avast blocked my download of printer drivers/config utility from Epson saying the site is blacklisted. Anyone know why this is?

[DavidR]

You can use the - Reporting a Possible False Positive File or Website - https://www.avast.com/false-positive-file-form.php.
You should get a response in a day or two.

I don't know if this may have more to do with it being FTP and your URL in the attached image indicates a mix of https //: ftp - The reason I don't know if the Web Shield is confused by the two different protocols.

I did a search for another source with that driver (not Epson) - https://www.driverguide.com/driver/detail.php?driverid=2122919 - ENCU_4.9.5 - I was able to download the driver update file and no alert by avast.

It could also be how did you go about getting this driver update ?

[jeff0000]

Thanks for that, I'll see what they way. The download link was from the Epson support page
https://epson.com/Support/Printers/Single-Function-Inkjet-Printers/WorkForce-Series/Epson-WorkForce-Pro-WP-4020/s/SPT_C11CB30201?review-filter=Windows+11

[DavidR]

You're welcome.

I visited your link and despite my having use my current Epson multi function printer for many years (I haven't ever updated its driver).  Having looked at the 'Drivers and Utilities Combo Package', I assume (dangerous I know), but the actual download link (image) looks like it is the problem.

Hover over it and it reveals what I consider to be the problem a malformed URL with that mix of https and ftp (it shouldn't need that ftp, it should work with only https).  The http, https and ftp are different protocols and it could be that this flip between https and ftp that Avast is getting suspicious at.  See attached.

Note I also changed the OS to win10 64bit what I have or it may have had a whinge.

[Rundvleeskroket]

ftp comes after the "://", so it's just a part of the url, and not a protocol. If an Avast shield is confused by that, it is very dumb.

Modern browsers have stopped support for the ftp protocol, so this looks like Epson just kept the name but made it an https site. It isn't an actual ftp.


https://http.ftp.https.avastshouldntbeconfusedbythis.edu would be a perfectly stupid but also perfectly valid url structure.

[DavidR]

Well I did try once to actually copy and paste the full url given in the OPs avast alert window into my browser, clicking enter/return resulted in a question of what program did I want to use.  So I didn't even get as far as an Avast alert.

[bob3160]

I received the same block and am reporting it to Avast.

Reported a clean on VirusTotal https://www.virustotal.com/gui/url/ce0fcc16110123ca3adf04784b44f70bb60736823d5b8f82cac4c9873fc59c31

[bob3160]

Just received the following from Avast Support:
Thank you for reporting this false positive.[/size]We have now cleared its reputation in our database based on the findings and removed the detection. This change may take up to 24 hours to take full effect. Please accept our apology for the inconvenience caused.It is no longer detected.[/color]