In the past week a number of my users have noted that my site has been marked as a phishing site, but most are not seeing this including myself. I have a number of security errors in my logs, which all come back to this javascript file: https://community.naturephotographers.network/assets/vendor-95…

Somehow you’ve ended up on Google’s phishing list: Google Transparency Report I think all you can really do is fill in the form they link to: Report Incorrect Phishing Warning

I noticed a number of the URL’s that were causing security errors are throwing a 402 Payment Required, for example here are the Sucuri scan results for one of the pages: Sucuri SiteCheck - Free Website Security Check & Malware Scanner

Do we even return 402 anywhere in our code paths @sam ? It is a very odd response value 402 Payment Required Reserved for future use. The original intention was that this code might be used as part of some form of digital cash or micropayment scheme, as proposed for example by GNU Taler, but that …

Are you sure your host isn’t causing this? Where is your site hosted, with what company? The “requires payment” response code is very curious indeed and makes me think this is about money and hosting.

With digitalocean and everything is current :man_shrugging:t2:

It’s your members only page which is returning the 402 errors. When I follow the URL mentioned in the site scan manually, it gives me a members only login page. [image] But when I request it using a command line tool, I’m getting a 402 Payment required. Which seems logical given the fact that it …

Ahh yes, this is from the Category Lockdown plugin , I looked through the code and it does use 402, @david could it be causing the phishing warnings? I see the plugin hasn’t changed since October but maybe something in core is conflicting? I will try disabling it and see if the users still get the wa…

Overnight the only new error in the logs is this one, and another user reported getting the warning around the same time as this Error: Could not find module discourse-common/lib/raw-handlebars Url: https://community.naturephotographers.network/assets/ember_jquery-07f49b58317ea9292d939348ec0091eb5…

[image] davidkingham: @david could it be causing the phishing warnings? I can’t say for certain, but a google search doesn’t bring up any examples of 402s being used as an indicator for phishing sites. In fact the first google result is this topic :wink: . I think in this case ‘402’ is actua…

Thanks David, after disabling my users are still getting the red screen, so I guess it rules that out.

Site marked as phishing site by browsers

Support

davidkingham (David Kingham) December 21, 2018, 3:47pm 11

It appears the site is not secure for these users, yet the certificate is valid and doesn’t expire until February:

Topic		Replies	Views
Discourse CDNs are blocked by privacy badger Site feedback	47	12906	August 15, 2017
Sucuri reports a malware infection? Support	6	2439	June 8, 2024
freeCodeCamp.org Discourse is Collapsing from Spammer Scripts Self-hosting	16	5140	July 3, 2020
Avatar, Site Logos, and Cert Errors Self-hosting unsupported-install	61	4057	May 25, 2020
CSRF login error after upgrade to 2.5.0.beta4 Support	12	1561	June 9, 2020

Site marked as phishing site by browsers

Related topics