Threat Secured Message on Livescore website

I see that Avast flags up a threat when accessing the Livescore website. The apparent issue is ‘cdn-ukwest.onetrust.com’ and is blacklisted.

Livescore is one of the biggest websites in the world for checking on sports matches. Will this be addressed? They’re obviously not malicious.

I can confirm I got the same thing (Cdn UKWest) saying ‘URL:Blacklist’ on this page (not all the time): https://yougov.co.uk/topics/politics/survey-results/daily/2020/11/18/50a62/3?utm_source=twitter&utm_medium=daily_questions&utm_campaign=question_1

Naturally, Yougov I’m sure is not carrying anything malicious so slightly confused…

I have no issue visiting the site (in the second post), using Firefox and latest version of avast Free and latest VPS version, see attached images.

I edited my post just to say that it doesn’t seem to crop up each time I visited that page. Very odd.

Interesting. I also get the alert on the YouGov site, so we must have some sort of patch or browser similarity. I’m a premium user on Chrome.

Ok within seconds all sites are suddenly fine again. Something has obviously just been rectified!

Rather bizarrely I still get it when trying to look at that Yougov page!

I have noted I need to update Avast’s application so I’ll do that and see if it helps.

I would suggest that you clear your browser cache and restart the browser and see if it still happens.

If it does, next step do a manual VPS (Virus Definitions) update and restart the OS that should certainly force the use of the new virus definitions if they were updated.

I’ll give these a try and report back to you :slight_smile:

Tried both of these and it still appears on that website! Updated avast, cleared cache.

Full virus scan and malwarebytes scan also returned absolutely no issues.

The issue does not appeare every single time I visit the site. Probably only once every 10-20 times I try the link. Do you think it could be a false positive?

Do you think it could be a false positive?
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

I just wonder if the site has Ads displayed from 3rd party sources, as these could possibly trigger it.

The next time you get an avast alert, do a screen capture of the avast alert window and attach it to your next post.

See my attached image of how to do it :wink:

Just tried and got this

I had the same issue as this, I would get it on different websites including: www.betfair.com, flashscore.co.uk. I’ve deleted cookies from the last 7 days and it seems to have cleared. Not sure what the problem was?

Update: Actually just gone back to those websites and alert is back even after clearing cache.

That’s exactly the same as mine (and others here). I use an adblocker (uBlock Origin) so it is strange that it does appear to be linked to an ad. If you click ‘more details’ does it say ‘banner’ in the URL at the end.

Also doesn’t seem to be a browser based issue given first poster and myself use Chrome, and yourself Firefox.

I’ve tested it on the regular Yougov homepage (https://yougov.co.uk/) and the same thing appears. Can anyone else confirm?

Might have been nice to see what the See Details showed.

Still no alert on my system on the link you gave.

Does this help David

For the record I can confirm that is exactly what I see.

@ schmidthouse
It helps in that, what is actually being alerted on doesn’t appear to be on the actual yougov.co.uk site, there is something redirecting to the suspect site and crucially this suspect javascript script templates otBannerSdk javascript file.

This could be why not every connection triggers an avast alert, so something on the yougov.co.uk site has an external call to this suspect site and suspect javascript file. But it could just alerting on the fact that the onetrust.com site. Or what I tried trying to visit the site.

So it would appear that parameters need to be passed on the url path in your see details image as I just get a script error (see attached. But crucially I didn’t get an alert on either the onetrust.com site or the ukwest.onetrust.com site as displayed in the alert as URL-Blacklist

So still a mystery as to why that call to ukwest.onetrust.com and the scripttemplates/6.6.0/otBannerSdk file. Given its name otBannerSdk I just wonder if this is some sort of Ad Banner being pulled in. That however is speculation on my part, but I don’t appear to be bumping into it when visiting the yougov.co.uk site.

I do use uBlockOrigin and uMatrix addons in Firefox.