Google flags my sites as dangerous (Deceptive site ahead)

Support
,
63

Hi! Just bringing not-so-good news but I suspect this might have to do with some internal scoring Google (or any other phishing list provider, Cisco, Fortinet, etc. they share their data that’s why it often appears flagged in 3-4 databases), and I suspect some of the websites get a bad scoring because of a combination of these factors:

  • weird/cheap TLD used by phishers: some engines automatically give a bad score to those
  • newly seen domains: I know that Cisco for example offers a DNS service that can block all domains not in Cisco’s database yet. This is very efficient against phishing since that’s how phishing websites operate. This would also explain why sometimes the website is unblocked after a few days.
  • maybe as mentioned, the fact that the website redirects to a login form also triggers their scoring algorithm since it looks like a phishing form (but I don’t believe what was mentioned earlier with the 301 and 302 redirects, as 302 redirect is the correct use for an SSO login)

So as a solution I think we’re stuck with asking whichever vendor to lift their ban on a flagged domain…

1 Like
64

FZbk64cUYAEh7fo
FZbk64cUYAEh7fo2048×1542 281 KB

FZbk7XnVsAA42Of
FZbk7XnVsAA42Of2048×1542 241 KB

FZVdeRmUIAAJfQH
FZVdeRmUIAAJfQH1920×1446 197 KB

Google thinks my Private Home Assistant that runs on YunoHost is trying to scam ppl… a private website… ugh im so sick of this

so mad i cant even use the home assistant app soon as i open it it sees the scary msg it now crashes and wont stop till google fixes my domain i can only access their through a web browser right now but on tablet web browser on split screen looks strange

1 Like
65

Version of yunohost: 4.3.6.3 (stable)
Version of ssowat: 4.3.3.1
Where is hosted your server: VPS Ionos
Apps list: Jirafeau 4.4.0 ynh1 // nextcloud 22.2.10~ynh1 // prettynoemiecms 2020.01.07~ynh2 // rainloop 1.16.0~ynh4
Domains number: 4
Affected domains: 3 (fcostes.fr / files.fcostes.fr / docs.fcostes.fr)
For each affected domains, give a link to the virus total test: fcostes.fr
files.fcostes.fr
docs.fcostes.fr
page SSO du domaine fcostes.fr en erreur
Have you put some links on social media (like youtube, instagram, etc.) which display the sso page ? NO
Have you find an app that was infected ? If yes, which app ? NO

Hi everyone, i’m also experiencing this issue of wrongful phishing notice: the first one in early may, then a second time and third time in a row on the 1rst and 6th of August.
For the 1rst and 2nd notice, a simple reaxam form did the job without doing anything on the server. I applied a 3rd exam this morning and waiting.

What happened between the 2nd and 3rd notice is the use of Jirafeau and the download of a file uploaded on the jirafeau instance by a third-party user (normal use-case).
Could this use-case have triggered the Google Safebrowsing phishing notice ?

Have a good day all, i’ll update this post to keep you informed if needed

Edit :
I submitted Yesterday evening (August 08th) a security review request and this morning the message was gone, so it was treated in less than 12hours.

Edit 2
This morning my site was again flagged as dangerous (social engineering). I asked for a review immediately, i’ll update when removed.

66

this has been happening to BTCPay servers as well

the BTCPayServer folks thought maybe it was because 1 btcpay server was used by someone in a malware campaign (ransomware) so now some app somewhere thinks all of them are malicious.

But this theory flagging based on “redirection to a login page” behaviour – thats interesting. Cuz I know BTCPayServer does that too. Perhaps there is a fix that us software developers can implement by “hiding” the login page or requiring users to click a link before it displays the login form?

edit: note this is just a theory!! AFAIK we have no idea why these flags are happening

1 Like
67

I looked to find someway of having a static ‘home’ page as the landing page, but could not find any option or app like that in YNH. I don’t mind having to click out to my login page … it’s an extra click but not a big deal. Anyone know how to make this happen?

68

I’m not familiar with YunoHost so I’m not sure how to achieve it, perhaps you could edit the nginx configuration file and then restart nginx?

This appears to be the file defining redirect to login behaviour yunohost/redirect_to_admin.conf at dev · YunoHost/yunohost · GitHub

location / {
    return 302 https://$http_host/yunohost/admin;
}

and it looks like redirect_to_admin.conf gets installed by this script yunohost/15-nginx at 140e50253fac0d3c9aa6fcab9e392a462c914e98 · YunoHost/yunohost · GitHub

    nginx_dir="/etc/nginx"
    nginx_conf_dir="${nginx_dir}/conf.d"
    ....

    mkdir -p $nginx_conf_dir/default.d/
    cp "redirect_to_admin.conf" $nginx_conf_dir/default.d/

so it looks like that file would be in your server at /etc/nginx/conf.d/default.d/redirect_to_admin.conf

Also I should point out, what I said is pure theory and speculation, we have no idea if this is actually the cause or not.

69

May be some of you can test to install a customwebapp with a very simple HTMLpage on /site/ and make this app as the default app.

3 Likes
70

I don’t know enough about how to set it up … if someone does this, please post instructions.

71

Yes no need to tweak the Nginx config, the customwebapp package mentioned can be found here: GitHub - YunoHost-Apps/my_webapp_ynh: Custom Web app with SFTP access

72

Thanks Guilhem, i made request like you and it’s solve the problem. No so easy for a beginner to add a txt dns record. But it’s the only way i know to fix this google flag.

73

Could you explain why you had to do that ?

74

When you get flagged by Google - One of the ways you get them to review your case is to add the Google file or txt record to your dns to verify ownership.

75

So adding a custom webapp and making it the main domain worked. One of my domains is now working properly and not getting flagged.

However - I setup one of my other domains and servers (new debian install - fresh yunohost install).
Once it was setup I ran the dignosis, made the recommended changes and stepped away to make a coffee.

On a site with no installed apps it took about 8 minutes for that domain to be reflagged as dangerous.

Yes, I now have a process to work through to clear this *hopefully permanently" but I can understand why some are struggling with this. I’m still hooked though, love Yunohost and will persevere through this.

2 Likes
76

I never had this issue at all

77

Due to this issue, I will unfortunately need to abandon using this wonderful tool, as today, my site has been flagged for the fourth time.
I’ve done several tests. I removed all applications, leaving only the core system, and even then I am flagged.

Really I would like to understand the cause of this problem, but I haven’t found the logic of the cause.

Complementing my comment, I saw reports of users recommending the registration of TXT records in DNS for Google to identify domain ownership.
I already have it registered since I got the domain because I use Google Workspace services.

4 Likes
78

Donc, mon serveur a été encore une fois tagué deceptive.
Dans la console de google :

Pages trompeuses :
https://mondomain.tn/yunohost
https://mondomain.tn/yunohost/
https://mondomain.tn/yunohost/admin
https://mondomain.tn/yunohost/admin/
https://mondomain.tn/yunohost/sso/
https://mondomain.tn/yunohost/sso/?r=aHR0cHM6Ly9ob21lLmFiZGVsaGVkaS5jb20udG4v

Le message associé :

Contenu d’ingénierie sociale détecté sur

App list :

admin@home ~> sudo yunohost app list | grep 'name\|version'
    name: DockerUI
    version: 0.0.1~ynh1
    name: Element
    version: 1.11.2~ynh1
    name: IFM
    version: 2.6.3~ynh3
    name: Joomla blog
    version: 4.1.5~ynh1
    name: custom .tn
    version: 4.1.5~ynh1
    name: LXD Dashboard
    version: 3.4.0~ynh2
    name: Matomo
    version: 4.10.1~ynh2
    name: Mattermost
    version: 7.1.2~ynh1
    name: Misskey
    version: 12.110.1~ynh2
    name: Custom Webapp
    version: 1.0~ynh5
    name: amos custom
    version: 1.0~ynh7
    name: Custom fm
    version: 1.0~ynh9
    name: Navidrome
    version: 0.47.5~ynh3
    name: NetData
    version: 1.33.0~ynh1
    name: Nextcloud
    version: 22.2.10~ynh1
    name: Photoview
    version: 2.3.12~ynh1
    name: phpMyAdmin
    version: 5.1.3~ynh1
    name: PhpSysInfo
    version: 3.4.1~ynh1
    name: Cusdis (redirect)
    version: 1.0.1~ynh1
    name: Site Redirect
    version: 1.0.1~ynh1
    name: Roundcube
    version: 1.5.3~ynh1
    name: Scratch
    version: 3.0~ynh1
    name: Slingcode
    version: 0.2.2~ynh4
    name: Strut
    version: 20220404~ynh1
    name: TrustyHash
    version: 1.0~ynh1
    name: Uptime Kuma
    version: 1.17.1~ynh1
    name: Wallabag
    version: 2.5.1~ynh2
    name: Webmin
    version: 1.997~ynh1
    name: Blog perso
    version: 0.13.1~ynh3

21 domaines.
Le problème concerne le domaine principal uniquement, d’autres sous-domaines du même domaine ne sont pas concernés.
Autre point, hier tout était normal. J’avais effectué la mise à jour vers 4.4.2.11 ce matin.

2 Likes
79

image
image1356×767 42.5 KB

its back… google reflagged all my domains, feels like a monthly attack.

yunohost is going to have to change how it does its redirects its login or setup or i might have to move on to something new.

YunoHost needs to ditch its SSO - Single Sign on

1 Like
80

https://transpay.transposées.eu/

image
image1027×480 37.5 KB

81

nah simply u need to create a file named robots.txt

User agent: *
Disallow: https://example/yunohost/sso/
1 Like
82

Where should that file be created ?
Thanks for the tip

1 Like