App Review McAfee Web Protection Test

It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
Content created by
EDR Experts
I probably need to uninstall / reinstall firefox but don't know why that should be necessary, but good to know McAfee ext is working for you & others with firefox.

For various reasons I've imaged back & installed McAfee three times & Firefox extension installed OK - Maybe you offended McAfee when you refused it the first time :p

(We doing a crowdfunding for someone to fly over & reinstall Firefox for you) :p:p I'm in the US but not until October if you can wait until then...
 
Last edited:
Might sound dumb, but is it possible if you could attach virustotal to this tool, showing how many engines on vt has detected the url youre testing on

Sure if the extension or antivirus web shield/filter used blocks like 98,5% of 67 urls you know that its doing well

Anyways, keep doing videos as you have talent for it. For me it seems youre like knowledge book of internet security(y)
As long as VirusTotal doesn’t want me to pay for it

Thanks, you’re very kind.
 
@Moonhorse I've just studied the public API and unfortunately, for free, VirusTotal only allows 4 requests per minute. Whilst I can create a "queue" and scan just 4 URLs per minute, I am not sure if it's going to be an optimal solution. Anyway, I am playing with the API, we'll see how it will turn out.

Anyway, this is how it looks now:
1754047671260.png


This URL is from real-world malware, loader that downloads a bunch of other malware.

With phishing, it's a different story though.

1754049360380.png


1754049389774.png
 
Last edited:
Yeah, I know on Reddit, you get downvoted to hell if you so much as hint towards recommending McAfee. Sure, it used to be bad, but now it's actually an antivirus you might want.
It’s true that it used to be bad, but if you look back, none of them were amazing.

What about Norton that at one point (for a good few years) would flag all unknown executables as WS.Reputation.1? It was a nightmare for developers.

Or Trend Micro, the installation of which used to take more than 10 minutes…

Or Sophos that had at least 15 background processes.

Avast kernel drivers not once or twice caused BSODs…

Problem is people compare those versions of McAfee from years ago with what’s available now.

Whatever it is, in an ocean of AVs, many of them free, a lot of people renew their McAfee subscriptions. So there are happy customers too.

Wasn't that the case with Adobe, when you downloaded the Flash Player plugins, Adobe pushed the McAfee installer along with it? Or am I confusing it with another AV? Does anyone remember this?
It was McAfee Security Scan or something that they distributed. There was something similar from Norton (it served as a platform to make you purchase a paid product). A lot of AVs were distributed through these partnerships and questionable means.
 
@Moonhorse I've just studied the public API and unfortunately, for free, VirusTotal only allows 4 requests per minute. Whilst I can create a "queue" and scan just 4 URLs per minute, I am not sure if it's going to be an optimal solution. Anyway, I am playing with the API, we'll see how it will turn out.

Anyway, this is how it looks now:
View attachment 289940

This URL is from real-world malware, loader that downloads a bunch of other malware.

With phishing, it's a different story though.

View attachment 289941

View attachment 289942
Thats impressive work, and was implemented pretty fast....sad its scanning limits will reduce the usefullness of this feature, sure we have that phishing/malware/web filter discussion here in MT wich compares different suites web blocking capalities ( been inactive lately tho)

But int the past some users took like 5 antiviruses / extensions/dnses and tested like 10-15 urls against them and we pretty much found out the best product for blocking just like that, and they were tested quite often aswell. Sad its dead thread these days.

Even thought this Virustotal implement on your tool probably wasnt the best idea, i respect you took time and tried it out.

Im not into coding at all, im just interested about internet security so i cant help you with the implementing these things but i can throw awaysome ideas i have

We can wait for more technically experienced people to appear into this thread
 
Even thought this Virustotal implement on your tool probably wasnt the best idea, i respect you took time and tried it out.
It was actually a pretty good idea, those 67 URLs, would’ve been scanned in about 17 minutes, which is not that bad. 17 min is doable.

Yeah, it will be easier if few people are commissioned to do the tests. If I were to test few different security solutions myself, problem is, by the time I do them one by one, the freshness of links/malware already fades.
The solutions tested last have unfair advantage in terms of time.

Anyway, if the malware hub or other testing parts of MalwareTips are revived, I can provide my tools.

Nevertheless, the VT integration was a great idea, thanks!
 
It was actually a pretty good idea, those 67 URLs, would’ve been scanned in about 17 minutes, which is not that bad. 17 min is doable.

Yeah, it will be easier if few people are commissioned to do the tests. If I were to test few different security solutions myself, problem is, by the time I do them one by one, the freshness of links/malware already fades.
The solutions tested last have unfair advantage in terms of time.

Anyway, if the malware hub or other testing parts of MalwareTips are revived, I can provide my tools.

Nevertheless, the VT integration was a great idea, thanks!
Is there a chance you could share the tool you used to verify links?
 
The links are gathered from several sources.

What sources did you use? I could not watch the video:

1754399097822.png


For phishing, most attacks end after one day (even if the website is not dead). Many attacks last a few seconds/minutes/hours. About 1/4 or more detections are ineffective in the wild because the websites are blocked too late. The effective detections are mainly related to long-term phishing.
 
Last edited:
What sources did you use? I could not watch the video:

View attachment 290016

For phishing, most attacks end after one day (even if the website is not dead). Many attacks last a few seconds/minutes/hours. About 1/4 or more detections are ineffective in the wild because the websites are blocked too late. The effective detections are mainly related to long-term phishing.
I am not sure what happened with the video… I will have to investigate when I have the time. It says the account is closed… I never closed it….

Anyway, McAfee released several technologies (I am tracking the patents) which analyse websites in real time, by rendering the website in an “invisible” headerless browser. McAfee uses reputation analysis, visual fingerprinting, AI and LLM analysis (amongst others), analyses favicons and logos (for example page has facebook logo, but the domain is faceblook.com) and so on.

These technologies are very similar to Check Point Zero Phishing, which is a reference in blocking phishing attacks.

Even in a Check Point Zero Phishing style, recent McAfee patent details starting the deep analysis when user clicks on a field. That’s how Check Point does it.

The URLs were taken from Phishtank, OpenPhish, some of my inboxes which are spam galore and Check Point Phishing feeds to which I have access,
 
Patent / App. No.TitleKey FeatureSummary & Relevance
US 20240094974 A1Just-in-Time Phishing DetectionOn-Click AnalysisInitiates a deep phishing analysis only when a user clicks on a sensitive input field (e.g., username, password), balancing performance with security.
US 12,132,761Icon based phishing detectionFavicon AnalysisAnalyzes a website's favicon by hashing it and comparing it against a database of known legitimate and malicious icons.
US 12,069,091Visual detection of phishing websites via headless browserHeaderless BrowserRenders a webpage silently in the background to analyze its visual structure and elements, detecting impersonation of legitimate sites.
US 20240364736 A1Phishing Detection via Grammatical ArtifactsGrammar AnalysisScans webpage text for spelling and grammatical errors, which are common indicators of phishing pages.
US 12,367,252Method and apparatus for real-time classification of web contentReal-Time ClassificationCore technology for analyzing and classifying website content on-the-fly to block malicious pages before they fully load.
US 11,949,873Method, apparatus, and computer-readable medium for detecting a man-in-the-middle phishing attackMITM DetectionAnalyzes network traffic and digital certificates for anomalies to detect sophisticated man-in-the-middle interception attacks.
US 11,889,520Universal resource locator based phishing detectionURL AnalysisUses machine learning to analyze the structure and characteristics of a URL itself to predict if it's malicious, going beyond simple blocklists.
US 11,575,695Malicious website detection based on aggregated security analyticsAggregated AnalyticsCombines data from multiple security sources (user reports, sandbox analysis, etc.) for a more confident and accurate threat assessment.
US 11,546,419Detecting phishing sites using machine learning models trained with brand independent featuresBrand-Agnostic MLEmploys machine learning models trained to spot universal phishing traits, making it effective against attacks impersonating new or unknown brands.
All these patents belong to McAfee LLC (after the split), the Trellix business division and patents are under the legal name Musarumbra LLC (they are not related to consumer products).
 
Anyway, McAfee released several technologies (I am tracking the patents) which analyse websites in real time, by rendering the website in an “invisible” headerless browser. McAfee uses reputation analysis, visual fingerprinting, AI and LLM analysis (amongst others), analyses favicons and logos (for example page has facebook logo, but the domain is faceblook.com) and so on.

Looks promising.:)
 
Looks promising.:)
It definitely is, in another bunch of patents (related this time to malware analysis), McAfee details multi dimensional malware analysis through “bucketizing” (that’s their term, I personally would call it clustering).

So from my test and antivirus log (some of them were published on various McAfee threads), McAfee calls several engines to analyse the file. These engines put the malware in what appears to be 51 “buckets” along with similar malware.

Every engine (HTI online reputation, Behavioural Cache, these are the what’s already known engines, UWP analysis engine, Real Protect Static Analysis, Yara rules, generic detections, these are the quick code analysis engines and Neo emulation, this is the dynamic analysis engine) classifies the file in a “bucket” based on its confidence and similarity to other malware.

In the end, the overall confidence is calculated to determine whether file should be removed.
Patent number 12282555 (very recently granted).
 
I could not watch the video:
A user who was hurt (probably Kaspersky, MalwareBytes, Bitdefender or who knows which product fan) reported the channel for "SPAM and SCAM". I've just appealed with YT. In the future, I will find another platform to host my videos most likely.
 
Bruh, these snowflakes can't take that McAfee is good now
They can't take when anything else, apart from their one and only favourite product is in the spotlight and doing the job well.
They want everyone and the whole forum to use only their chosen product and talk only about it.
Any other discussion creates questions like "I thought we hate McAfee" or "Why is everyone suddenly using McAfee".
Anyway, I think I still have the video on the Windows laptop.

If not, I have my tools, I can always perform another test.