Tell HN: Ycombinator.com Blacklisted by Norton

https://news.ycombinator.com/item?id=12839757

by rmdoss • 10 years ago

63 34 10 years ago

news.ycombinator.com

Just got a warning when trying to visit ycombinator.com:

https://safeweb.norton.com/report/show?url=ycombinator.com

Seems like a false positive, but might be worth to get it cleared.

sbierwagen• 10 years ago

All the listed threats are formulaformillionaires.com links, which is odd.

schoen• 10 years ago

Maybe people are posting these links as stories and they're getting flagged quickly but Norton still sees them and thinks of them as site content?

AvenueIngres2• 10 years ago

And formulaformillionaires.com redirects to medium.com. Weird.

tedmiston• 10 years ago

Also, the owner looks like a normal author [1].

    $ whois formulaformillionaires.com

    Updated Date: 20-sep-2013
    Creation Date: 01-feb-2008
    Expiration Date: 01-feb-2018
    ...
    Admin Name: Paul McCormick
    Admin Organization: Miracle Writers LLC
    ...

Google says [1]:

Some pages on this website send visitors to the following dangerous websites: apollo-computers.com.

Edit: Upon further inspection it looks like a pretty questionable book: "Become a millionaire by just following my 7 simple steps!"

[1] https://amzn.com/0979433835

[2] https://www.google.com/transparencyreport/safebrowsing/diagn...

philip12092• 10 years ago

Probably a Cloudflare IP got flagged then switched to serving YC traffic

scrollaway2• 10 years ago

We got that same issue on joust.hearthsim.net (serving an S3 static site), it's getting blocked in russia because some website used to be on the IP it's currently routed to, back in 2013 or some such.

Annoying. Any suggestions?

jgrahamc4• 10 years ago

Did you talk to Cloudflare support about that?

jgrahamc4• 10 years ago

ycombinator.com is not handled by Cloudflare; it appears to be on Amazon.

jonknee• 10 years ago

Hmm...

  nslookup news.ycombinator.com
  Server:     192.168.1.1
  Address:    192.168.1.1#53

  Non-authoritative answer:
  news.ycombinator.com    canonical name = news.ycombinator.com.cdn.cloudflare.net.
  Name:   news.ycombinator.com.cdn.cloudflare.net

philip12092• 10 years ago

You're correct - at least one of the subdomains (hacker news) is on CF and I assumed the main site was on it too.

I don't know how Adobe flagging works - it's possible that detecting an issue on a subdomain would cause them to flag the apex. That being said, the same recycled-IP issue could apply to the Amazon load balancer / CDN.

[Edit] Looks like they do indeed classify by apex. So, news.ycombinator.com redirects to ycombinator.com on the Adobe database, e.g. https://safeweb.norton.com/report/show?url=news.ycombinator....

Aldo_MX• 10 years ago

Hopefully the bureaucracy to get removed from the blacklist is not as bad as with other vendors.

schwap• 10 years ago

It's not really a static blacklist as such. Sites are added and fall off of it regularly.

EddieSpeaks• 10 years ago

Something to do with Peter Thiel?

cosmeen• 10 years ago

How did you got this warning, what Norton product are you using?

ivan_gammel2• 10 years ago

In my case it's Norton 360.

ivan_gammel2• 10 years ago

I've got this warning too.

xiwaeo• 10 years ago

got a warning notice from my antivirus (Norton). what's up?

phoboslab• 10 years ago

This happened to a site I managed a while ago. The cause was a comment a user posted that was flagged as a "batch virus". The content of the comment was all text, along the lines of

   @echo off
   echo "Speeding up your PC!"
   delete c:\Windows\system32\

Thanks Norton!

deanstag• 10 years ago

Thanks OP. Norton will blacklist HN again!

gnu8• 10 years ago

Norton probably blacklisted HN for this comment because it infringes on their intellectual property, not merely because it is potentially destructive code. In other words, it duplicates the functionality of some of their products and they don't appreciate their trade secrets being exposed this way.

hellofunk• 10 years ago

I was going through some old patent applications from 2015 and found this exact code snippet in Pat. #482739HG by one of Norton's subsidiary companies.

markwaldron2• 10 years ago

You can submit it to get whitelisted here: https://submit.symantec.com/false_positive/

yomly• 10 years ago

It's a gathering point for hackers - of course it would be flagged.

Mz• 10 years ago

Nefarious, evil and tricksie people who might actually get things done.

For shame.

nikanj• 10 years ago

This is what we get for repeatedly making fun of Symantec

dknecht• 10 years ago

Is this still happening to anybody? I am with Cloudflare and will escalate if still a problem.

sctb• 10 years ago

It looks like it's OK for me, now: https://safeweb.norton.com/report/show?url=news.ycombinator....

markwaldron2• 10 years ago

Just got an email from Norton saying they have resolved the issue.

Email: http://imgur.com/a/2WwXf

Tell HN: Ycombinator.com Blacklisted by Norton

Related Stories