Jump to content

Browser guard - false positive on website


mak0001
Go to solution Solved by Dashke,

Recommended Posts

Domains:

keyauth.cc
keyauth.win


Malwarebytes browser guard will let me load my website but then once loaded, it seems to block AJAX calls made.

https://keyauth.cc/app/license-fetch.php
https://keyauth.cc/app/user-fetch.php

This is happening with another domain I use too, https://keyauth.win

https://keyauth.win/app/license-fetch.php
https://keyauth.win/app/user-fetch.php

There's more but here's a few. These are made by datatables.js, they're post requests with cookies in them.

I noticed that Malwarebytes browser guard was intercepting these, and returning 0 bytes with a 307 internal redirect code.

As soon as I allowed keyauth,cc, the problem went away. I'm pretty sure this has only started recently, I've had browser guard for a while without problems.

I've attached an image which seems to indicate that browser guard thinks my site is malicious. Please remove any false positives on my website. My customers are having the same problem.

I operate an open-source software licensing system for programmers to use for authenticating users. https://github.com/KeyAuth there is nothing malice about my site.

keyauth-malwarebytes-browser-guard.png

Link to post
22 minutes ago, Dashke said:

Hello, mak0001,

Thank you very much for your patience, the block has been removed.
Wish you a malware free day!

It's still occurring for both domains:

keyauth.cc

keyauth.win

I appear to be on the latest version, 2.6.5

 

It's a 307 internal redirect and the response header for Location: is set to chrome-extension://ihcjicgdanjaechkgeegckofjjedodee/app/eventpages/block.html?referrer=undefined&url=https%3A%2F%2Fkeyauth.cc%2Fapp%2Fuser-fetch.php&host=keyauth.cc&type=scam&subtype=phishing&tabId=1501514411&filename=undefined&prevUrl=null

 

ihcjicgdanjaechkgeegckofjjedodee is the Malwarebytes browser guard extension ID.

 

It's odd because if I just go to the home page, it doesn't block me or show red text with a bug icon. It's only for these AJAX calls that it's a problem.

mb-keyauth-3.PNG

mb-keyauth-1.PNG

mb-keyauth-2.PNG

Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.