Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

False Positive | clear-armor.com #1117

Open
candycaineb opened this issue Feb 7, 2025 · 13 comments
Open

False Positive | clear-armor.com #1117

candycaineb opened this issue Feb 7, 2025 · 13 comments
Assignees
@g0d33p3rsec
Labels
duplicate This issue or pull request already exists

Comments

@candycaineb
Copy link

What are the subjects of the false-positive (domains, URLs, or IPs)?

clear-armor.com

Why do you believe this is a false-positive?

I believe this is a false-positive because...
We have ensured all safety best practices and have found no malware or vulnerabilities on the site. All scanning tools and manual checks determine the site to be safe

How did you discover this false-positive(s)?

Other (Please fill out the next box)

Where did you find this false-positive if not listed above?

I discovered this false-positive by...
Few/certain secured networks flag this site as malicious and phishing.

Have you requested a review from other sources?

I have requested a review from...
Yes, everyone has removed the site from their phising dbs
https://www.urlvoid.com/scan/clear-armor.com/

Do you have a screenshot?

[Screenshot](https://docs.google.com/document/d/18_2eRWIEwesZt5ACQp5n_11yILenSOVJ2YSI3H7tALI/edit?usp=sharing)

Additional Information or Context

I have also noticed that...
@phishing-database-bot
Copy link
Member

Verification Required

@candycaineb, thank you for submitting a false positive report! To help us verify your ownership of the affected domain(s), please complete the following steps:

  1. Set a DNS TXT record for the domain(s) listed in this issue with the following details:

    • Record Name: _phishingdb
    • Record Value: antiphish-323f8c3979a4a46742211817ce00efc6251c6118

    Your Verification ID: antiphish-323f8c3979a4a46742211817ce00efc6251c6118

  2. Wait for DNS propagation (this may take a few minutes to a few hours).

  3. Reply to this issue once the TXT record has been set.

Important Notes

  • Verification does not guarantee whitelisting. The Phishing.Database team will review your report after verifying ownership, but the decision to whitelist depends on further investigation and analysis.
  • If the record cannot be set or you need alternative methods of verification, please contact us at [email protected] - preferably from the domain's official email address.

How to Check the TXT Record ?

You can verify that the TXT record is properly set using:

Thank you for your cooperation! We will address your issue as soon as possible after verification.

The Phishing.Database Project Team.

@spirillen
Copy link
Contributor

Please solve title on issue to match your domain

@candycaineb
Copy link
Author

Verification Required

@candycaineb, thank you for submitting a false positive report! To help us verify your ownership of the affected domain(s), please complete the following steps:

  1. Set a DNS TXT record for the domain(s) listed in this issue with the following details:

    • Record Name: _phishingdb
    • Record Value: antiphish-323f8c3979a4a46742211817ce00efc6251c6118

    Your Verification ID: antiphish-323f8c3979a4a46742211817ce00efc6251c6118

  2. Wait for DNS propagation (this may take a few minutes to a few hours).

  3. Reply to this issue once the TXT record has been set.

Important Notes

  • Verification does not guarantee whitelisting. The Phishing.Database team will review your report after verifying ownership, but the decision to whitelist depends on further investigation and analysis.
  • If the record cannot be set or you need alternative methods of verification, please contact us at [email protected] - preferably from the domain's official email address.

How to Check the TXT Record ?

You can verify that the TXT record is properly set using:

Thank you for your cooperation! We will address your issue as soon as possible after verification.

The Phishing.Database Project Team.

Just added this as a txt record, thanks!

@spirillen
Copy link
Contributor

how did you add _phishingdb.example.com to example.com?

@spirillen
Copy link
Contributor

ptcheck clear-armor.com antiphish-323f8c3979a4a46742211817ce00efc6251c6118
The test value does not match the DNS TXT record.

Thanks for using my tools.
Please consider a sponsor ship at https://www.mypdns.org/donate

@candycaineb candycaineb changed the title False Positive | example.com False Positive | clear-armor.com Feb 7, 2025
@candycaineb
Copy link
Author

candycaineb commented Feb 7, 2025 via email

@candycaineb
Copy link
Author

candycaineb commented Feb 7, 2025 via email

@spirillen
Copy link
Contributor

It should have been propagated after an hour, check your serial (SOA record)

Image

@candycaineb
Copy link
Author

candycaineb commented Feb 7, 2025 via email

@spirillen
Copy link
Contributor

That seems better

$ ptcheck clear-armor.com antiphish-323f8c3979a4a46742211817ce00efc6251c6118
The test value matches the DNS TXT record.

Thanks for using my tools.
Please consider a sponsor ship at https://www.mypdns.org/donate

Now lets move on...

@spirillen
Copy link
Contributor

Search results

Lookup provided by My Privacy DNS

Hosts-Sources

External Hosts-Sources can be found here

Ultimate.Hosts.Blacklist1.csv:clear-armor.com
phishing_database/ALL-phishing-links.csv:clear-armor.com
phishing_database/phishing.database/domain.csv:clear-armor.com

Sorted result



EasyList




Matrix blacklist project




Matrix blacklist project, Filtered




Response Policy Zone - RPZ


Did not find any matching RPZ records


Known Issues


rgxRecord: clear-armor.com



DNS lookup


ns1.virtualave.net.
ns2.virtualave.net.
;; Warning: Client COOKIE mismatch


HTTP header


HTTP response, click to expand

HTTP/2 403 
date: Fri, 07 Feb 2025 23:23:19 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: max-age=15
expires: Fri, 07 Feb 2025 23:23:34 GMT
server: cloudflare
cf-ray: 90e72089cb86ebdc-ARN
alt-svc: h3=":443"; ma=86400




      		
    

  





        


            

            

              
            

        

      


      

            
  

    
  
    
    

  

  



    












      

  
      



  

  @spirillen





  


    

      

  

    

        
    
    

  


      
          
  
      
            Copy link

  

      
    

  


  

      

  
    Contributor


      

  


  

    

  





      


        


  
    

      
          
I've said this so many times, public domains only. How should I be able to verify you domain are clean, when you lock the door?


How do you feel when you get invite somewhere and then the door get locked right in front of you??


Read more about CloudFlare's meta sheep farm inside their walled garden and the problems about them



Image

      		
    

  





        


            

            

              
            

        

      


      

            
  

    
  
    
    

  

  



    












      

  
            

    

      
    

    


      

          @spirillen
spirillen




              removed their assignment


      Feb 7, 2025

    

  



    

    

      
    

    


      

          @spirillen
spirillen




          moved this from 🆕 New
  to 🚫 Blocked / Waiting
  in Phishing Database Backlog


      Feb 7, 2025

    

  



  

  

    
  


  

      

    @spirillen
spirillen



    mentioned this issue
    
      Feb 8, 2025
    





  


  

      
  
  Closed

  







  









      

  
      



  

  @spirillen





  


    

      

  

    

        
    
    

  


      
          
  
      
            Copy link

  

      
    

  


  

      

  
    Contributor


      

  


  

    

  





      


        


  
    

      
          
duplicate of #1068

      		
    

  





        


            

            

              
            

        

      


      

            
  

    
  
    
    

  

  



    












      

  
            

    

      
    

    


      

          @spirillen
spirillen




          added
  the 

  duplicate

  This issue or pull request already exists
 label


      Feb 8, 2025

    

  












  
  

    

      

  





  




  
  

              

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  



  






  
                  




    

  


      
  

    Assignees
  



        

      

        

  
      @g0d33p3rsec
  
    g0d33p3rsec
    

      








      


  


  

    Labels
  



    

      

    duplicate

  This issue or pull request already exists








      

  

    

        

    Projects
  


        




        
  

    

      
          
        Phishing Database Backlog
        
    

    

      

            
    Status: 🚫 Blocked / Waiting

              
      

    

    

  







  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    
      

        
    

    Development
  




          
    
No branches or pull requests







    
  




      

    

  
      

  

    

      6 participants
    

    

        
          @mitchellkrogza 
        
          @funilrys 
        
          @candycaineb 
        
          @spirillen 
        
          @g0d33p3rsec 
        
          @phishing-database-bot