# 浏览器将该网站标记为钓鱼网站 **URL:** \ **Category:** Support\ **Created:** [2018年十二月21日 05:05 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814 "2018-12-21T05:05:49Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 05:05 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/1 "2018-12-21T05:05:49Z")
In the past week a number of my users have [noted](https://community.naturephotographers.network/t/not-able-to-open-images/2870) that my site has been marked as a phishing site, but most are not seeing this including myself. I have a number of security errors in my logs, which all come back to this javascript file: [https://community.naturephotographers.network/assets/vendor-957bcfd0b1422c19974dcf8f64f73eeada523e3d12dd3c76eb24c753f9399397.js](https://community.naturephotographers.network/assets/vendor-957bcfd0b1422c19974dcf8f64f73eeada523e3d12dd3c76eb24c753f9399397.js) Most of the reports of this happening were Sunday night and then everyone seemed to stop getting the warning, but now I have people emailing me again stating that it’s happening again today. It seems like it may be CDN related as the common theme is with images. I contacted digital ocean and they said they were not seeing any problems on their end. Any ideas? > **Log env** > > | hostname | community-app | > | --- | --- | > | process\_id | [24095, 24114] | > | application\_version | bcf4a1775169698f103c78c4ec61fecedd21e3f8 | > | HTTP\_HOST | community.naturephotographers.network | > | REQUEST\_URI | /logs/report\_js\_error | > | REQUEST\_METHOD | POST | > | HTTP\_USER\_AGENT | [Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko, Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko, Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko, Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; ASU2JS; rv:11.0) like Gecko, Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko] | > | HTTP\_ACCEPT | _/_ | > | HTTP\_REFERER | [https://community.naturephotographers.network/](https://community.naturephotographers.network/) | > | HTTP\_X\_FORWARDED\_FOR | [209.170.230.242, 76.241.9.23, 12.235.114.66, 217.116.64.52, 24.117.75.79, 71.84.189.197, 173.244.130.100, 50.0.118.42, 72.210.21.39] | > | HTTP\_X\_REAL\_IP | [209.170.230.242, 76.241.9.23, 12.235.114.66, 217.116.64.52, 24.117.75.79, 71.84.189.197, 173.244.130.100, 50.0.118.42, 72.210.21.39] | > | params | | > | message | SecurityError Url: [https://community.naturephotographers.network/assets/vendor-957bcfd0b1422c19974dcf](https://community.naturephotographers.network/assets/vendor-957bcfd0b1422c19974dcf) | > | url | [https://community.naturephotographers.network/assets/vendor-957bcfd0b1422c19974dcf8f64f73eeada523e3d1](https://community.naturephotographers.network/assets/vendor-957bcfd0b1422c19974dcf8f64f73eeada523e3d1) | > | line | 2 | > | column | 9962 | > | window\_location | [https://community.naturephotographers.network/](https://community.naturephotographers.network/) | ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 05:41 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/2 "2018-12-21T05:41:46Z")
I noticed a number of the URL’s that were causing security errors are throwing a 402 Payment Required, for example here are the Sucuri scan results for one of the pages: [Website Security Checker | Malware Scan | Sucuri SiteCheck](https://sitecheck.sucuri.net/results/https/community.naturephotographers.network/t/suwannee-river/2843/2) ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2018年十二月21日 06:00 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/3 "2018-12-21T06:00:10Z")
Do we even return 402 anywhere in our code paths @sam? It is a very odd response value > ### 402 Payment Required > > Reserved for future use. The original intention was that this code might be used as part of some form of digital cash or micropayment scheme, as proposed for example by GNU Taler, but that has not yet happened, and this code is not usually used. Google Developers API uses this status if a particular developer has exceeded the daily limit on requests. Sipgate uses this code if an account does not have sufficient funds to start a call. Shopify uses this code when the store has not paid their fees and is temporarily disabled. It is possible your scanner was hitting a Discourse rate limit, though I find the usage of 402 rather ambiguous. There is a proper response code for rate limiting, 429 > ### 429 Too Many Requests (RFC 6585) > > The user has sent too many requests in a given amount of time. Intended for use with rate-limiting schemes. ---
**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\ **Post date:** [2018年十二月21日 06:08 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/4 "2018-12-21T06:08:42Z")
Are you sure your host isn’t causing this? Where is your site hosted, with what company? The “requires payment” response code is very curious indeed and makes me think this is about money and hosting. ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 06:11 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/5 "2018-12-21T06:11:57Z")
With digitalocean and everything is current 🤷🏻‍♂️ ---
**Author:** ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)\ **Post date:** [2018年十二月21日 06:21 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/6 "2018-12-21T06:21:48Z")
It’s your members only page which is returning the 402 errors. When I follow [the URL mentioned in the site scan](https://community.naturephotographers.network/t/suwannee-river/2843/2) manually, it gives me a members only login page. ![image](https://global.discourse-cdn.com/meta/original/3X/3/d/3d551058412fd31ce0fb2f6e6b452569849394be.png) But when I request it using a command line tool, I’m getting a 402 Payment required. Which seems logical given the fact that it actually requires payment in order to get to the content. ![image](https://global.discourse-cdn.com/meta/original/3X/8/9/89f7758b508393442e62120e66388deee2b74aa0.png) Nevertheless I’m wondering if this is what is actually causing the phishing site warnings. ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 14:16 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/7 "2018-12-21T14:16:21Z")
Ahh yes, this is from the [Category Lockdown plugin](https://meta.discourse.org/t/advertise-activity-in-a-private-category-discourse-category-lockdown/70649/6), I looked through the code and it does use 402, @david could it be causing the phishing warnings? I see the plugin hasn’t changed since October but maybe something in core is conflicting? I will try disabling it and see if the users still get the warning. ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 14:25 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/8 "2018-12-21T14:25:15Z")
Overnight the only new error in the logs is this one, and another user reported getting the warning around the same time as this Error: Could not find module discourse-common/lib/raw-handlebars Url: [https://community.naturephotographers.network/assets/ember\_jquery-07f49b58317ea9292d939348ec0091eb50a9d8aaabd9e86cc074ef5f049918aa.js](https://community.naturephotographers.network/assets/ember_jquery-07f49b58317ea9292d939348ec0091eb50a9d8aaabd9e86cc074ef5f049918aa.js) Line: 19 Column: 11853 Window Location: [https://community.naturephotographers.network/c/image-critiques/landscape-critiques](https://community.naturephotographers.network/c/image-critiques/landscape-critiques) | hostname | community-app | | --- | --- | | process\_id | 32693 | | application\_version | e655e1863f07d1304393efa14a6726f5f622ef75 | | HTTP\_HOST | community.naturephotographers.network | | REQUEST\_URI | /logs/report\_js\_error | | REQUEST\_METHOD | POST | | HTTP\_USER\_AGENT | Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0 | | HTTP\_ACCEPT | _/_ | | HTTP\_REFERER | [https://community.naturephotographers.network/c/image-critiques/landscape-critiques](https://community.naturephotographers.network/c/image-critiques/landscape-critiques) | | HTTP\_X\_FORWARDED\_FOR | 46.208.87.187 | | HTTP\_X\_REAL\_IP | 46.208.87.187 | | params | | | message | Error: Could not find module discourse-common/lib/raw-handlebars Url: [https://community.naturephotogr](https://community.naturephotogr) | | url | [https://community.naturephotographers.network/assets/ember\_jquery-07f49b58317ea9292d939348ec0091eb50a](https://community.naturephotographers.network/assets/ember_jquery-07f49b58317ea9292d939348ec0091eb50a) | | line | 19 | | column | 11853 | | window\_location | [https://community.naturephotographers.network/c/image-critiques/landscape-critiques](https://community.naturephotographers.network/c/image-critiques/landscape-critiques) | | stacktrace | s@[https://community.naturephotographers.network/assets/ember\_jquery-07f49b58317ea9292d939348ec0091eb5](https://community.naturephotographers.network/assets/ember_jquery-07f49b58317ea9292d939348ec0091eb5) | ---
**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\ **Post date:** [2018年十二月21日 14:30 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/9 "2018-12-21T14:30:20Z")
> [@davidkingham](#): > > @david could it be causing the phishing warnings? I can’t say for certain, but a google search doesn’t bring up any examples of 402s being used as an indicator for phishing sites. In fact the first google result is this topic 😉 . I think in this case ‘402’ is actually the correct error code - payment is required to view the content. ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 14:38 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/10 "2018-12-21T14:38:58Z")
Thanks David, after disabling my users are still getting the red screen, so I guess it rules that out. ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 15:47 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/11 "2018-12-21T15:47:25Z")
It appears the site is not secure for these users, yet the certificate is valid and doesn’t expire until February: ![image](https://global.discourse-cdn.com/meta/original/3X/f/5/f527d4116d010889cecb76762e0dc31854b56d23.png) ---
**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\ **Post date:** [2018年十二月21日 15:54 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/12 "2018-12-21T15:54:01Z")
Somehow you’ve ended up on Google’s phishing list: [Google Transparency Report](https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Fnpn.sfo2.cdn.digitaloceanspaces.com%2Fwp-content%2Fuploads%2F20181023105736%2FNPN-Favicon400-100x100.png&hl=en-GB) I think all you can really do is fill in the form they link to: [https://safebrowsing.google.com/safebrowsing/report\_error/?hl=en-GB](https://safebrowsing.google.com/safebrowsing/report_error/?hl=en-GB) ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 15:58 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/13 "2018-12-21T15:58:53Z")
But I don’t think I am on the list, it’s just a browser trigger. If I check the site on [Sucuri](https://sitecheck.sucuri.net/results/https/community.naturephotographers.network) it doesn’t show on any list, and most users including myself are not getting this warning. The only connection I can make is that all the red screens reference the digitalocean cdn and the users getting this warning are not able to load images (I have my image hosting through a digital ocean space with cdn) ---
**Author:** ![Hector](https://avatars.discourse-cdn.com/v4/letter/h/43a26b/32.png) [@Hector](https://meta.discourse.org/u/Hector)\ **Post date:** [2018年十二月21日 16:13 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/14 "2018-12-21T16:13:38Z")
You are on the list. Did you follow the link for more information? The url that’s on the list is the digital ocean cdn ([npn.sfo2.cdn.digitaloceanspaces.com](http://npn.sfo2.cdn.digitaloceanspaces.com)). Perhaps someone uploaded a phishing site there and is sharing the link, not necessarily in your forum site. > **[Google Transparency Report](https://transparencyreport.google.com/safe-browsing/search?url=https:%2F%2Fnpn.sfo2.cdn.digitaloceanspaces.com)** ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月21日 17:01 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/16 "2018-12-21T17:01:41Z")
Thanks guys, I didn’t see the link David posted at first. I didn’t think of checking the DO link, I have submitted to google for review and we will see where it goes from here. I do find it odd that it is only affecting a handful of users still. ---
**Author:** ![davidkingham](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davidkingham/32/119528_2.png) [@davidkingham](https://meta.discourse.org/u/davidkingham)\ **Post date:** [2018年十二月23日 20:51 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/17 "2018-12-23T20:51:35Z")
DigitalOcean finally got back to me and acknowledged that someone on their network had uploaded phishing material and it has now been resolved. It’s a bit crazy that they are not siloed, thank you all for your help. ---
**Author:** ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)\ **Post date:** [2019年一月22日 21:03 UTC](https://meta.discourse.org/t/site-marked-as-phishing-site-by-browsers/104814/18 "2019-01-22T21:03:21Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.