Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False Positives found #3

Open
KnightTim opened this issue Jun 30, 2019 · 161 comments
Open

False Positives found #3

KnightTim opened this issue Jun 30, 2019 · 161 comments

Comments

@KnightTim
Copy link

I have been using the list for a little bit, I like the idea and it seems like a pretty solid block list but I have run into a few false positives in the last couple days.

ci4.googleusercontent.com
ci5.googleusercontent.com
ogs.google.com
online.jimmyjohns.com
vortex.accuweather.com

The first 3 are related to showing images in emails on gmail.
The 4th is a website for ordering food.
The 5th is for displaying rader/maps in the accuweather app

@KnightTim
Copy link
Author

I have found 2 more domains.

www.travelocity.com
www.orbitz.com

They are websites for booking travel.

mkb2091 added a commit that referenced this issue Jul 1, 2019
Also added some other false positives to whitelist
@mkb2091
Copy link
Owner

mkb2091 commented Jul 1, 2019

I've added all those domains to the whitelist, thanks for reporting them

@KnightTim
Copy link
Author

Found a major false positive.

www.amazon.com

@mkb2091
Copy link
Owner

mkb2091 commented Jul 8, 2019

Sorry about that. I've added it to the whitelist, so it should not be blocked now. An IP address(72.21.211.176) which according to passive dns( https://www.virustotal.com/gui/ip-address/72.21.211.176/relations ) used to be for amazon got into a blocklist. It seems like the IP is no longer used for www.amazon.com, which suggests that there is a bug in the code, since the code is meant to check if domains returns via passive dns are still go to the target IP address. I'll fix the code soon, but for now, just whitelisting the domain should be enough

@KnightTim
Copy link
Author

KnightTim commented Jul 11, 2019

I think I may have found an issue and may have figured out why www.amazon.com was blocked, or I have another theory.

I noticed several more sites blocked:
www.go.com www.skyrock.com www.ask.com www.conduit.com www.vmn.net www.tagged.com www.ku6.com www.soso.com

All of them have the www. at the start but the base domain of go.com isn't blocked, but other subdomains are.
So my guess is the logic currently checks if *.go.com is blocked but www.go.com is not in the list add it. I think what it should check is, if go.com is not blocked do not add www.go.com

Does that make sense? And do you agree?
Also if you want I can close this issue and open a new one for this comment.

@mkb2091
Copy link
Owner

mkb2091 commented Jul 11, 2019

For go.com, it isn't blocked because go.com was added to a whitelist I use, but www.go.com wasn't. I'll change it so for any domain, if domain.com is whitelisted, so will www.domain.com

@mkb2091
Copy link
Owner

mkb2091 commented Jul 11, 2019

The current version does not contain www.skyrock.com, www.tagged.com(nor tagged.com), www.ku6.com(but does block ku6.com, through some version of dbl.oisd.nl does), www.soso.com(nor soso.com, also blocked by some version of dbl.oisd.nl)

@mkb2091
Copy link
Owner

mkb2091 commented Jul 11, 2019

Thanks, changing the whitelisting to also whitelist www.example.com even if only example.com is whitelisted seemed to of removed 136 false positives

@KnightTim
Copy link
Author

Found 4 more domains, I had to unblock them to get the Windows Store to work on Win8.1

next-services.apps.microsoft.com
wscont.apps.microsoft.com
wscont1.apps.microsoft.com
wscont2.apps.microsoft.com

mkb2091 added a commit that referenced this issue Jul 21, 2019
@KnightTim
Copy link
Author

Found another: i.ibb.co
It is used for the image hosting service https://imgbb.com/

@KnightTim
Copy link
Author

Found few more false positives

lowendbox.com
completion.amazon.com
links.mint.com
web.tresorit.com

mkb2091 added a commit that referenced this issue Oct 6, 2019
@mkb2091
Copy link
Owner

mkb2091 commented Oct 6, 2019

I couldn't find anything that links.mint.com actually broke on the website, so I can't tell if its actually needed, would you mind saying what it breaks?

@KnightTim
Copy link
Author

links.mint.com breaks the ability to click on links in the mint emails.

mkb2091 added a commit that referenced this issue Oct 6, 2019
@mkb2091
Copy link
Owner

mkb2091 commented Oct 6, 2019

OK, thanks for explaining what it breaks. I've whitelisted it, and also reported it to the upstream list

mkb2091 added a commit that referenced this issue Oct 15, 2019
Also added some other false positives to whitelist
mkb2091 added a commit that referenced this issue Oct 15, 2019
mkb2091 added a commit that referenced this issue Oct 15, 2019
mkb2091 added a commit that referenced this issue Oct 15, 2019
@gadkarisid
Copy link

False positive for domains including "adafruit." It's a legit online retailer.

mkb2091 added a commit that referenced this issue Nov 15, 2019
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
mkb2091 added a commit that referenced this issue Aug 12, 2021
@KnightTim
Copy link
Author

Found a "major" false positive

inbox.google.com

It prevents the Gmail app from updating and giving notifications.

@mkb2091
Copy link
Owner

mkb2091 commented Aug 18, 2021

That was fixed in #103, but I'll add it to the whitelist to be safe for the future in case another list adds it

@cusco
Copy link

cusco commented Oct 11, 2021

Hi, I'm not sure if this is the correct way to report, or didn't find the reason why its listed.
Seems to me that c.paypal.com stops me from using paypal checkout functionality on some websites.

mkb2091 added a commit that referenced this issue Oct 11, 2021
@mkb2091
Copy link
Owner

mkb2091 commented Oct 11, 2021

Hi, I'm not sure if this is the correct way to report, or didn't find the reason why its listed. Seems to me that c.paypal.com stops me from using paypal checkout functionality on some websites.

Yeah this is a fine way to report it, thanks for doing so. c.paypal.com is blocked because https://raw.githubusercontent.com/hermanjustinm/Herms-Blacklist/master/HermsAdBlacklist.txt and https://raw.githubusercontent.com/jerryn70/GoodbyeAds/master/Hosts/GoodbyeAds.txt both block it. I've removed

@M0lyk
Copy link

M0lyk commented Nov 4, 2021

Hi, I think this is a false positive :
majax31isnotdown. blogspot.com/

Thank you

@mkb2091
Copy link
Owner

mkb2091 commented Nov 6, 2021

@M0lyk it is in the list because it is in https://raw.githubusercontent.com/blocklistproject/Lists/master/malware.txt, which is a list for malware. The site appears to be distributing patched software, so I'm not surprised it got marked as malware as it very well could be

@MoralCode
Copy link

MoralCode commented May 15, 2024

secure.bannerbank.com is a false positive (Match found in https://raw.githubusercontent.com/mkb2091/blockconvert/master/output/domains.txt)

also www.bannerbank.com

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests