Kaspersky blocks(URL blocked) sites without opening them, False positives? [merged]

[Rimanah]

Is this supposed to be like it? First of all I want to assure you I do not have any active malware that would try to open anything - you can test it out yourself. I for exampe just search a dangerous site and Kaspersky instantly blocks it without opening.  Does it mean something tried to load, or is it just some sort of “prevention”? Because if something did try to load, I find it strange, since I didnt open anything. This happens in google search. I also recently used Google Images and found it strange that the same sort of warning came out(about phising) when clicking on(increasing size) image, but without going on the site. So the question presits, am I in danger if I even search a dangerous site or when I focus(by clicking) a google image?

[Flood and Flood's wife]

Hello @Rimanah,

Welcome!

✅ KIS/KSN has many features actively at work to protect you✅  

• Re “(I) search a dangerous site and Kaspersky instantly blocks it without opening”, that’s good, KIS/KSN is working, otherwise the system may get infected. 
• The web is full of “phishing”, embedded in images, in seemingly harmless documents, “apparently” safe sites - everywhere - KIS/KSN blocking is exactly what is needed to ensure your system stays uncontaminated. 
• Post the KIS, All events, 24hrs or 7days Report - see video guide, attach📎 to your reply, so we can review the KIS detections please? Link

   

Thank you🙏

Flood🐳

[Rimanah]

This is the site that got blocked. My question presists: Is it harmful to JUST search a dangerous site? And also is it dangerous JUST to click on(without opening the site) image in Google Images?

[Flood and Flood's wife]

@Rimanah,

You’re welcome!

Protecting personal data on the Internet > Checking a website for safety

• Kaspersky Internet Security allows checking the safety of a website before you click a link to open it. Websites are checked using URL Advisor.
• The URL Advisor component checks links on a web page opened in Chromium-based Microsoft Edge, Google Chrome, or Mozilla Firefox. Kaspersky Total Security displays one of the following icons next to the checked link:

 – if the linked web page is safe according to Kaspersky

 – if there is no information about the safety status of the linked web page

 – if a web page opened from a link could be used by criminals to harm your computer or data, according to Kaspersky

 – if the linked web page is dangerous according to Kaspersky

To view a pop-up window with more details on the link, move the mouse pointer to the corresponding icon.

By default, Kaspersky Internet Security checks links in search results only. You can enable link checking on every website.

• Re  “Is it harmful to JUST search a dangerous site?

Referring to the following image, if any of the sites with red Kaspersky icons were accessed, the potential for contamination exists. 

 

• Re  “ is it dangerous JUST to click on (without opening the site) image in Google Images? “

Selecting an image from the general Google tpagon search, KIS/KSN automatically detects a problem and assists (you) with alerts

 

Note: sometimes, detections may be false positives, the way to find out is:

1. Scan any detected URL using Kaspersky Threat Intelligence Portal
2. Raise a case with Kaspersky Technical Support, provide a detailed history, images, they may ask for Traces, captured as the issue is replicated & they may also request a GSI & Windows logs.
3. ❓ Ask them to determine if the detection is correct?
4. After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will communicate with you, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in your MyKaspersky account.

Thank you🙏

Flood🐳

[Rimanah]

Thanks a lot, but I still need to know that one thing. I know it pop up shows saying it was blocked when I even just search it. I want to know if the searching itself is dangerous, since it popped up, or if it;’s just blocking before I can access it as a prevention.

[Flood and Flood's wife]

@Rimanah,

You’re welcome!

As we explained above, we opened Google images search for tpagon, we “clicked” on the first image, KIS/KSN immediately blocked dangerous URL, if you choose to ignore the KIS/KSN advice you do so at your own peril. 

Thank you🙏

Flood🐳

[Rimanah]

@Rimanah,

You’re welcome!

As we explained above, we opened Google images search for tpagon, we “clicked” on the first image, KIS/KSN immediately blocked dangerous URL, if you choose to ignore the KIS/KSN advice you do so at your own peril. 

Thank you🙏

Flood🐳

Yeah, going on that site could be unsafe, but just clicking on the image, it shouldn’t right?

[Flood and Flood's wife]

@Rimanah,

Clicking on the image immediately prompts KIS/KSN to block - draw your own conclusions. 

Thank you🙏

Flood🐳

[Rimanah]

Logically speaking it shouldn’t be dangerous, yet it gets “blocked”. That;’s why I ask because there shouldn’t be anything to block

[Flood and Flood's wife]

@Rimanah,

• As we previously advised: sometimes, detections may be false positives, the way to find out is:

1. Raise a case with Kaspersky Technical Support, provide the KIS Report, a detailed history, images, they may ask for Traces, captured as the issue is replicated & they may also request a GSI & Windows logs.
2. ❓ Ask them to determine if the detection is correct?
3. After submitting the case, you’ll receive an automated email with an INC+12digits reference number, then, normally, within 5 business days, a Kaspersky Technical Support human will communicate with you, also by email, you may continue to engage with the Kaspersky Technical Team via email or by updating the INC in your MyKaspersky account.

Thank you🙏

Flood🐳

[Berny]

I for example just search a dangerous site and Kaspersky instantly blocks it without opening. 

Also , please see this pinned topic

[Rimanah]

I for example just search a dangerous site and Kaspersky instantly blocks it without opening. 

Also , please see this pinned topic

I wasn’t infected. The thing is, that I find it strange Kaspersky even blocks the sites without opening(clicking on image for example)

[Rimanah]

I also found a site that does get “flagged” by just searching it  - ihgip(dot)net. I’m convinced this doesn’t mean there was literal danger, but it’s just “prevention”. What do you think?

[Rimanah]

(new submission added)

[Berny]

@Rimanah Please submit your question to  K-Lab Technical Support, this Forum cannot provide assistance related to malicious blocked websites.

 

 

 

 

[Rimanah]

@RimanahPlease submit your question to  K-Lab Technical Support, this Forum cannot provide assistance related to malicious blocked websites.

 

 

 

 

It is still very much related to this topic - I just want to know if it is dangerous, if you only search it? Because this one shows as “blocked” even though you didn’t even open it.

[Berny]

if you only search it?

When opening the link Kaspersky blocked the site.
Please contact K-Lab Tech Support who will confirm or deny a False Positive.

 

[Rimanah]

if you only search it?

When opening the link Kaspersky blocked the site.
Please contact K-Lab Tech Support who will confirm or deny a False Positive.

 

It doesn’t matter if it’s false positive or not - I want to know if it’s POSSIBLE to get infected by just searching it

[Berny]

@Rimanah Kaspersky is always protecting you when searching as well as opening  infected sites.
 

[Rimanah]

https://www.virustotal.com/gui/url/de7ddb87c31bf1752492d5edb8edd46b67b6c957563ede6704c1a2847cde4fc6/detection

 

https://www.virustotal.com/gui/url/2d1a9c67a9fe66fe3d9eb5271a77dbccec522503c36bcfd115aadd93d9696d89/detection

 

Kaspersky is the only site that detects these sites, are they truly dangerous?

[Flood and Flood's wife]

Hello @Rimanah,

Welcome again,

• We’ve covered both sites & the “detections” extensively, in your original topic Kaspersky blocks(URL blocked) sites without opening them.
• Our advice remains unchanged: please contact Kaspersky Technical Support. 

Thank you🙏

Flood🐳

[Rimanah]

This is unrelated. I’d be lovely, if anyone would know whether they are false positives or not.

[Flood and Flood's wife]

@Rimanah, 

As we’ve advised multiple times, the Kaspersky Technical Team have the resources to analyse & advise FPs. The Kaspersky Community does not. 

It’d be lovely if you’d accept and act on, the advice that’s been provided. 

False positive request template

Thank you🙏

Flood🐳

[Berny]

 I’d be lovely, if anyone would know whether they are false positives or not.

Here are the two options when you suspect a False Positive :

1 > Contact K-Lab Technical Support : 100% recommended
2 > Create an exclusion  : 100% NOT recommended