Hot Take Norton safe web continues to mark bad websites as safe support denies the claims.

[nickstar1]

So this has been brought up by many users here at MalwareTips i have finally reached out to support to "report the issue" they don't seem to care much about norton's new safe web marking sites as "safe" when they are malicious. Nothing to see here norton marks the site as safe you may proceed! This is absolutely crazy and instead of owning up to the issues users have reported. They continue to reflect and deny any wrong doing. I will not be supporting any GED digital products until this is fixed. I'm absolutely appalled at this response. I know many of you have reported these issues and know how serious this is. Essentially by marking bad websites as "safe" people could be potentially trusting them and falling for scams.

 

[Bot]

I understand your frustration. It's crucial for Norton to accurately mark websites for user safety. I suggest continuing to report these issues and hopefully, they'll address the problem soon.

 

[nickstar1]

This was crazy what do you guys think? Dont take my word for it do your research and you will see it as well. Norton should be able to stand on it's own installing other extensions such as Symantec browser protection isn't the answer either as normal consumers are not educated enough to know that.

 

[CyberDevil]

Shophos:

ChekPoint (ZoneAlarm/Harmony):

McAfee:

Fortinet:

Are you sure this site is dangerous? All major site categorization providers have marked it safe. It's not a Gen/Norton only problem.

 

[nickstar1]

Shophos:
View attachment 286705

ChekPoint (ZoneAlarm/Harmony):
View attachment 286706

McAfee:
View attachment 286707

Fortinet:
View attachment 286709

Are you sure this site is dangerous? All major site categorization providers have marked it safe. It's not a Gen/Norton only problem.

This is not a new issue for all gen products it is a very wide issue. This was also brought to attention to avast and they continue to ignore the issues. Norton safe web is now all avast. Avast: Safe - not safe at all

 

[CyberDevil]

This is not a new issue for all gen products it is a very wide issue. This was also brought to attention to avast and they continue to ignore the issues. Norton safe web is now all avast. Avast: Safe - not safe at all

onmicrosoft.com and even with the subdomain memercousuvc.onmicrosoft.com are shown safe by all vendors, and even by kaspersky. The domain is 20 years old. Unfortunately, I'm not sure that any AV solution would work here. The only way is to use AI for contextual and semantic analysis. I don't think anyone offers such a service now.

By the way, as I understand from Web Of Trust about the domain that started the thread, this company is just using bad business practices, but that doesn't make the site a phishing site as Kaspersky labeled it.

 

[nickstar1]

onmicrosoft.com and even with the subdomain memercousuvc.onmicrosoft.com are shown safe by all vendors, and even by kaspersky. The domain is 20 years old. Unfortunately, I'm not sure that any AV solution would work here. The only way is to use AI for contextual and semantic analysis. I don't think anyone offers such a service now.

By the way, as I understand from Web Of Trust about the domain that started the thread, this company is just using bad business practices, but that doesn't make the site a phishing site as Kaspersky labeled it.

That still does not explain the marking of phishing sites as "safe" by norton and avast browser plugins. Like i said do you're research against various sites you will see the plugin marking them "safe"

 

[CyberDevil]

That still does not explain the marking of phishing sites as "safe" by norton and avast browser plugins. Like i said do you're research against various sites you will see the plugin marking them "safe"

Are you talking about https://www.fharateguide.com ? I already asked you why you think it's phishing ?

 

[harlan4096]

I just reported that site to K., waiting final verdict.

 

[simmerskool]

I just reported that site to K., waiting final verdict.

FHA is a government loan run by HUD, so this website looks like 3d-party collecting data, I'd consider it "suspicious" (my 2 cents -- fwiw)

 

[Vitali Ortzi]

Are you talking about https://www.fharateguide.com ? I already asked you why you think it's phishing ?

It's probably malicious as it's blocked as spam by Symantec extension (by default it wouldn't block it but I have added spam category in my config) but it could be a false positive by both Kaspersky and Symantec

 

[harlan4096]

I just reported that site to K., waiting final verdict.

Hello,

Dear User,

Thank you for sending a request to Kaspersky!
We have checked the link you sent us.
It has been confirmed as a false positive and excluded from our data loss threat protection databases.

Best regards, Senior Web Content Analyst

 

[Vitali Ortzi]

Interesting that it was a false positive by Kaspersky as it rarely happens to Kaspersky
interesting what caused it to get flagged
Won't be surprised if there was once malicious activity from that domain

 

[simmerskool]

@harlan4096 ok analyzed as false+, but how does Kaspersky or anyone really know how that entity is using the data it collects to advise people on FHA housing loan? No complaints made? or K knows the data doesn't show up for sale on dark web??

 

[bjm_]

We resolved the domain fharateguide.com to IP address 172.67.74.183
This IP address has been reported a total of 1 time from 1 distinct source. It was most recently reported 6 months ago.
Old Reports: The most recent abuse report for this IP address is from 6 months ago. It is possible that this IP is no longer involved in abusive activities.
https://www.abuseipdb.com/check/172.67.74.183

 

[nickstar1]

So here is a site distributing info stealing malware reported on Malwarebytes forums by an expert "Norton flags the site as safe" I make my case..... Norton should be at least highlighting the site as "gray" or yellow. Before with the symantec extension it would at least mark them "yellow" or "gray".

 

[nickstar1]

Check a website at Scamadviser.com for a trust score

Check if a website is a scam website or a legit website. ScamAdviser helps identify if a webshop is fraudulent or infected with malware, or conducts phishing, fraud, scam and spam activities. Use our free trust and site review checker.

www.scamadviser.com

This website does not have many visitors

This website has only been registered recently.

 

[Vitali Ortzi]

So here is a site distributing info stealing malware reported on Malwarebytes forums by an expert "Norton flags the site as safe" I make my case..... Norton should be at least highlighting the site as "gray" or yellow. Before with the symantec extension it would at least mark them "yellow" or "gray".


View attachment 286722View attachment 286723

Looks safe and Symantec agrees

 

[nickstar1]

View attachment 286724
Looks safe and Symantec agrees

https://forums.malwarebytes.com/topic/320749-looking-for-help-on-knowing-if-this-malware-will-stay/

I'm shocked they marked it safe... They really should mark these sites as gray until manually verified especially if the whois data is suspicious.

 

[bjm_]

Norton 360 v24.12.9725
Virus definitions version 241223-4
Learn more about Safe Web here
-----------------------------------------------------
Safe Web extension
https: //www. leyamor. com
Norton Rating Warning
CURRENT CATEGORY Malicious Sources/Malnets
https://safeweb.norton.com/report?url=leyamor.com