Hello,
I'm the administrator of the website onarbeni.com, a legitimate small business site (a
home-repair services marketplace). Avast Web Shield is currently blocking visitors from
opening the site, showing a malicious/suspicious warning.
I have already submitted the official false-positive form at avast.com/submit-a-sample
more than 10 times over the past weeks, but nothing has changed — the site is still
blocked and I never receive any response or resolution.
A few facts that may help:
- The site is hosted behind Cloudflare on a shared IP address that is used by a very
large number of unrelated sites, which is a known source of false positives for some
security vendors.
- We have already resolved false-positive classifications with several other security
vendors (via VirusTotal) after contacting them directly — Avast is one of the last
ones still blocking us, and unfortunately the only one where the standard form hasn't
led anywhere.
Could someone from the team please take a manual look at onarbeni.com and let me know
what would help get this resolved? Happy to provide any verification needed (domain
ownership, WHOIS, etc.).
Thank you for your help.
First, I’m an Avast user and not an Avast Team member.
You won’t get a direct response but it should be analysed within 48 hours, if found to be false it will be removed.
However, I have run a check on the URL at VirusTotal and there are 10/90 detections with many of the scanners (29) returning it as unrated. This may be why Avast is still also detecting it
There are sites that can also check a site link.
- https://www.virustotal.com/ (results reported above)
- https://en.internet.nl/
- https://sitecheck.sucuri.net/
The last two links would be looking at vulnerabilities and or vulnerabilities.
First of all, thank you so much — even though you’re not an Avast employee — for taking the time to look into this and help us out. It really means a lot that a fellow user like you would offer this kind of support.
Yes, VirusTotal did once detect an infection on our site. We cleaned this infection, but we had to submit a separate cleanup request to each of the security providers listed by VirusTotal. We’ve managed to get most of them cleared — the number was over 30 at the start, and it has now dropped significantly. Some of these were other antivirus programs as well, and we cleaned all of them.
However, we’ve reported this to Avast many times — perhaps 10, maybe 20 times — submitting “false positive” reports. We’ve been dealing with just this issue for about a month now, but we haven’t received any response or been able to get anything resolved; the site is still showing as blocked. We’re continuing to try to get it cleared from all the lists.
What we’ve realized is this: it’s much easier for a site to get flagged with something like this than it is to get removed from these lists afterward. In other words, even if you’re clean on most providers, if even one or two still mark you as “suspicious,” you can be affected again almost without warning.
We’ll also take a look at the links you shared and check them.
Thank you again, personally, for taking the time to care about this.
You’re welcome.
My check at VirusTotal was a fresh one, the last one previously was about 14 days old (if my memory is correct) so the 10/90 detections was of a fresh rescan of the URL
This what was found on that VirusTotal scan, 10 detections plus one Suspicious).
I will try to draw some Avast Team attention to this, but with those numbers I’m not sure how they would proceed.
Thank you again so much for taking the time on this and for trying to draw the Avast Team’s attention to it for us — that’s really kind of you.
By the way, I was wondering: if you were in our position, what approach would you take with these numbers (10 detections + 1 suspicious)? Would it make more sense to keep doing what we’re currently doing — submitting separate “false positive” reports to each provider — or is there another approach you’d suggest?
1 Like
I don’t believe you can do anything else other than report individually.
As far as I’m aware there is no way of globally reporting it as a possible false positive, I don’t know if there is even a means of doing that on VirusTotal.
A case in point I see many instances of just two alerts 2/90 on VirusTotal, reporting it to Avast clears only the Avast Alert if found to be an FP, it won’t do anything for VirusTotal, as Avast is a live antivirus scanner (so you won’t see it in VT results).
Also If you check the link I gave you will also see many Unrated hits, was 30 of 90.
Hi @kullanıcı153 ,
Thank you for raising this!
The reported domain was checked, and based on the findings, the detection was removed. The website is now marked as clean in the Avast database. This change may take up to 1 hour to take full effect. Please accept my apology for the inconvenience caused.
If the situation persists after 1 hour, please update the Avast virus database and try again.
Thank you, @DavidR, for highlighting this topic.
1 Like
Hi Zee123,
Thank you so much for reviewing and resolving this issue so quickly, we truly appreciate it.
We had been trying to resolve this issue for a very long time — almost a month. We submitted dozens of forms, reported “false positive” many times, but we were never able to get a response or achieve any result. We’d also like to thank @DavidR separately for raising this.
We’ll wait for the change to take full effect, and if there’s still an issue after an hour, we’ll try again as you suggested.
Thank you again so much for your effort.
I’m happy to have been of assistance.
I have just visited the site and no alert only a we’re working on it page. I don’t know if this would be a good sige or that there is no underlying structure or content.
Translation:
“We are working on our platform that brings together those in need of service with reliable masters in their region. We will be live very soon.”
Hi David,
First of all, thank you again so much.
The “we’re working on it” page you mentioned is completely normal to see, since the site is still under development. Before this, the site wasn’t opening at all — not even a “under construction” page — because Avast had blocked the domain entirely.
Work on the site is ongoing. In the meantime, we also have a demo page available, which you’re welcome to check out:
——–onarbeni com / demo ——–
We can also confirm that the Avast warning no longer appears, which is a real relief for us.
Thank you again so much for your attention and help.
that's perfect
1 Like
You’re welcome.
