But why avast don’t block it if possue hidden iframe ?

poor avast!