phishing websites

polonus · 2017-09-25T12:20:16.000Z

Hi savcin,

Thank you very much, indeed. All neatly blocked as with url:mal ;D

Avast here blocks where a lot of others fail to detect.

That is how we like to see it.

polonus

Christophe2 · 2017-09-25T18:10:15.000Z

i still cant see the update

Asyn · 2017-09-26T05:57:09.000Z

polonus post:19:

Hi savcin,

Thank you very much, indeed. All neatly blocked as with url:mal ;D

Avast here blocks where a lot of others fail to detect.

That is how we like to see it.

polonus

We also should thank Christophe2, he’s the one who reported it.

Asyn · 2017-09-26T05:57:32.000Z

Christophe2 post:20:

i still cant see the update

Reboot the system.

Christophe2 · 2017-09-26T06:40:00.000Z

thanks it works, but the Avast extension I have on my browser doesn’t block it.

thanks

Asyn · 2017-09-26T06:42:05.000Z

You’re welcome. The web-shield should block it.

Christophe2 · 2017-09-26T06:45:49.000Z

look:

http://www.hostingpics.net/thumbs/76/47/94/mini_764794facepira.png

Avast doesn’t detect it!

Asyn · 2017-09-26T06:47:05.000Z

Got a bigger screenshot…!?

Christophe2 · 2017-09-26T06:51:04.000Z

https://img11.hostingpics.net/pics/853606facepira.png

Asyn · 2017-09-26T06:55:09.000Z

Works for me, see screenshot.

Christophe2 · 2017-09-26T06:57:48.000Z

normally it shoudl show this:

https://img11.hostingpics.net/pics/953525facepira.png

Asyn · 2017-09-26T06:59:53.000Z

Christophe2 post:29:

normally it shoudl show this:

Not anymore, anti-phishing is now included in web-shield.
See: https://forum.avast.com/index.php?topic=208020.msg1417667#msg1417667

Christophe2 · 2017-09-26T07:02:05.000Z

ok thanks, but if i disable avast, then it doesn’t work.

with the extension, even if avast is disabled, it shows all the time

thanks

Asyn · 2017-09-26T07:05:28.000Z

Christophe2 post:31:

ok thanks, but if i disable avast, then it doesn’t work.

thanks

Well, an expected result.
De rien.

Christophe2 · 2017-10-14T06:58:50.000Z

Hi Avast team,

You forgot to add these links.

Please update your database urgently!

Thanks

Christophe

polonus · 2017-10-14T08:45:44.000Z

Cristophe2,

Merci bien,

Easy to establish these new sites are not secure, example:
https://www.scamadviser.com/check-website/grandsecretduweb.com

Also listed at blocklist.de → https://www.abuseipdb.com/check/91.216.107.158
Operateur: https://registrydb.com/facebookaccounthack.net (www.lws.fr/ abuse).
This website looks like it’s hosted on a compromised server - 5 problems: https://mxtoolbox.com/domain/lws-hosting.biz/

Also apparently here non-public CloudFlare abuse is involved: http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Fwww.lws.info%2F

wXw.lws.info

Please contact the Certificate Authority for further verification.
This server cannot be scanned for these vulnerabilities:
Heartbleed
Server scan unsuccessful.
Poodle (TLS)
Server scan unsuccessful.

Common name: sni59442.cloudflaressl.com SAN: sni59442.cloudflaressl.com, *.a-a-hebergement.com, *.alain-prost.com, *.alain-prost.fr, *.ayrton-senna.fr, *.black-ravens.org, *.comparateur-hebergeur.com, *.domushellas.com, *.easyvaluedomain.com, *.eldrug.gr, *.fabbri-racks.co.uk, *.fabbri-racks.com, *.full-range-print.com, *.giannouris.net, *.hebergementwordpress.fr, *.hebergeur-discount.com, *.hostingrd.biz, *.isolo.biz, *.karampoula.gr, *.karampoulas.com, *.lws-hosting.be, *.lws-hosting.ch, *.lws-hosting.eu, *.lws.info, *.lws.lu, *.lwshosting.name, *.m52.ms, *.meilleurhebergeurweb.net, *.mister-hosting.fr, *.misterhosting.com, *.nietraco.nl, *.palchateo.chat, *.proland-estate.com, *.pure-biltong.co.uk, *.pure-biltong.com, *.purebiltong.co.uk, *.registrar-domain-name.com, *.ruedudomaine.com, *.ruedudomaine.fr, *.selflevelingcompounds.co.uk, *.top10hebergeursweb.com, a-a-hebergement.com, alain-prost.com, alain-prost.fr, ayrton-senna.fr, black-ravens.org, comparateur-hebergeur.com, domushellas.com, easyvaluedomain.com, eldrug.gr, fabbri-racks.co.uk, fabbri-racks.com, full-range-print.com, giannouris.net, hebergementwordpress.fr, hebergeur-discount.com, hostingrd.biz, isolo.biz, karampoula.gr, karampoulas.com, lws-hosting.be, lws-hosting.ch, lws-hosting.eu, lws.info, lws.lu, lwshosting.name, m52.ms, meilleurhebergeurweb.net, mister-hosting.fr, misterhosting.com, nietraco.nl, palchateo.chat, proland-estate.com, pure-biltong.co.uk, pure-biltong.com, purebiltong.co.uk, registrar-domain-name.com, ruedudomaine.com, ruedudomaine.fr, selflevelingcompounds.co.uk, top10hebergeursweb.com

COMODO ECC cert chain PositiveSSL Multi-Domain,Domain Control Validated

polonus

Christophe2 · 2017-10-15T08:07:58.000Z

Hi,

Thanks!

But did you updated your database to blocks them?

Thanks

Best Regards

polonus · 2017-10-15T15:57:56.000Z

Hi Christophe,

We here are just volunteers with relevant knowledge, we cannot block or unblock, that is only for Avast Team Members.
Hopefully one of them will add it to their list.

polonus (volunteer website security analyst and website error-hunter)

Christophe2 · 2017-10-16T15:10:48.000Z

hi, ok thanks

polonus · 2017-10-16T17:30:34.000Z

Hi Christophe2,

This one is redirecting and probably also not flagged: https://www.virustotal.com/#/url/c63192ddd6f207802f413f79e78f44387cca37e098566de66dea0a10a61ad4f1/detection
re: https://aw-snap.info/file-viewer/?protocol=not-secure&tgt=huit.re%2Fept&ref_sel=GSP2&ua_sel=ff&fs=1

Status codes These should normally all be the same.
GoogleBot returned code 301 to -http://ona.davidgagnon.org/ban/oyv
Google Chrome returned code 301 to -http://ona.davidgagnon.org/ban/oyv

See: http://toolbar.netcraft.com/site_report?url=http://ona.davidgagnon.org
and consider: http://toolbar.netcraft.com/site_report?url=https://id.orange.fr

This link comes blocked by a good ablocker: -https://all.orfr.adgtw.orangeads.fr/js/ora_authen.identification?sKW='+encodeURI(oan_siteKeywords)+'&sCT='+encodeURI(oan_siteContentTopic)+'

polonus

Announcements