I am reporting a false positive for the domain: scientology49 (DOT) fr
The site was previously compromised (HTML:Script-inf) but it has been fully cleaned and updated to latest Prestashop.
Current Status:
Google / Bitdefender / ESET / Sophos / Microsoft / Fortinet: ALL CLEAN.
VirusTotal score is currently 12/97 because major engines are already clearing the domain. You can check the report on VirusTotal for scientology49 (DOT) fr
Could you please re-evaluate the domain reputation and remove the block?
Iâve already submitted a False Positive report using the new location you mention several days ago, without response nor change re the false positive. Thatâs why Iâm looking for help here.
I also clicked several times on the False Positive button in avast itself and filled the indicated link www.avast[DOT]com/report-false-positive#pc to no avail.
The other links are to see if they find any weakness that could be exploited.
Unfortunately the lack of a response and it still being present, is that the check may have been run automatically rather than manually.
I donât know if you have been using the Avast Alert window to report a possible false positive, which I have just done. However they wouldnât know me from Adam rather than an Avast Forum regular.
So you could also submit it using the link I gave previously as that allows you to input more information.
Yes, I did use the Avast Alert Window to report a false positive, many times indeed:
And I know for a fact that Avast does react on reputation only and not on site analysis because I cloned my site onto another domain name and Avast does not signal any threat on that domain.
According to Gemini:
"What is Avast basing its block on? Avast does not scan your site every time a user clicks. It uses a hybrid system called CyberCapture and WebRep. Its judgment relies on three main pillars:
Signature History (HTML:Script-inf): Avast has recorded that scientology49.fr previously hosted a malicious script. Even though the script has been removed, the âInfected Domainâ entry remains in their Cloud database until a Time-to-Live (TTL) counter expires or a human validation clears it.
SSL Certificate Metadata: Occasionally, if the SSL certificate was issued or active during the infection, Avast flags the certificateâs digital fingerprint as suspicious.
Lack of âHealthyâ Traffic (Trust Score): Avast assigns a trust score to domains. A hacked siteâs score drops to zero. To recover, it requires either time or for the domain to be âclearedâ by other authorities. The fact that Microsoft and Bitdefender are now âCleanâ is your strongest argument, as Avast monitors the decisions of its competitors.
Why is Avast the hardest to unblock? Avast is particularly tenacious because it is highly protective of its free-tier users. Unlike Microsoft, which often unblocks as soon as a scan comes back clean, Avast frequently requires proof of cleanup or manual intervention from one of their technicians."
I used again the link you mention to input more information:
I tried to connect and got an alert, which I reported as a possible false positive. Which you can do and possibly better with the manual link for reporting a possible false positive given earlier.
I tried to connect and got an alert, which I reported as a possible false positive. Which you can do and possibly better with the manual link for reporting a possible false positive given earlier.
Interestingly after closing the alert windows, part of the site was displayed at which point Firefox was reporting a secure connection error/failure. I have no idea if this might be related to the Web Shield or not.
I have completed the final security hardening of the domain. Here is the definitive status of the infrastructure:
Official Whitelisting: CRDF Labs has officially removed the domain from their database (Ref #20260117543786) after manual verification.
Security Protocol (HSTS): I have enabled HSTS with a 12-month max-age, including subdomains, to ensure permanent encrypted connections.
TLS Configuration: I am now enforcing TLS 1.2 as the minimum version, with TLS 1.3 enabled. The site achieved a 100% score on Internet.nl in TLS 1.3 mode, and Iâve maintained a 98% score in the current balanced mode to ensure maximum compatibility with the greatest number.
Infrastructure: DNSSEC, IPv6, and RPKI are all fully active and verified.
Integrity: The PrestaShop installation has been upgraded to 1.7.8.11 and verified clean.
The PR_CONNECT_RESET_ERROR you previously encountered should be resolved by these standardized TLS settings.
I transmitted all this data via the indicated form in the hope it will at last escalate to the Avast Lab for the final whitelist synchronization.
Thank you for your invaluable help during this process!
I am writing this final update to report a critical anomaly in Avastâs filtering system regarding scientology49[.]fr.
As of today, the consensus in the cybersecurity industry has shifted decisively:
VirusTotal: The domain is now marked as CLEAN by 91 out of 94 security vendors.
Industry Leaders: Forcepoint, alphaMountain, Emsisoft, and Dr.Web have all manually reviewed and whitelisted the site in the last 48 hours.
Technical Excellence: The site scores 98% on Internet.nl and implements HSTS with a 12-month max-age including subdomains.
Legacy Issue: Avast is now among the last 3% of vendors worldwide still blocking this domain based on a resolved incident from November 2025.
At this stage, maintaining the block is no longer a security measure but a technical malfunction of Avastâs reputation database. This is causing unjustified prejudice to a site that follows the highest security standards (DNSSEC, RPKI, HSTS).
Could a staff member please perform a manual override? The community and automated tools have clearly spoken: the site is safe.
Thank you for the update. Itâs great news that itâs working on your end.
However, despite updating my Avast definitions and flushing my DNS, I am still getting the HTML:Script-inf [Susp] alert on my local machine (Screenshot attached).
On VirusTotal, we are now down to 2/94 (only Lionic and MalwareURL remaining). Since the central database seems clear, could this be a synchronization delay with specific regional servers or the Web Shieldâs heuristic engine?
I would appreciate it if you could mention to the team that while the âbumpâ worked for some, the local block is still affecting users in my region.
I am delighted to confirm that the issue is now fully resolved on my end.
After updating the Avast virus database and restarting, the website is accessible without any alerts.
Thank you MJay for your manual intervention in the database, and a huge thanks to DavidR for your continuous support and for âbumpingâ the case multiple times. This confirms that our security hardening (HSTS, DNSSEC, 98% Internet.nl score) is now correctly recognized by Avast.
