1

I was wondering how to report a false positive to Google Safe Browsing without having to create a Google account and feeding their insatiable hunger for more data?

I have not found such a way as of yet. Google pretty much seems intent on preventing any contact in this matter or others.

Background

My domain - yep whole one, including subdomains - was reported as (two examples):

Firefox blocked this page because it might try to trick you into installing programs that harm your browsing experience (for example, by changing your homepage or showing extra ads on sites you visit).

... and:

This site is unsafe

The site https://***********.net/ contains harmful content, including pages that:

Install unwanted or malicious software on visitors’ computers

I won't disclose my domain here, but given I have a list of digests for all the files located on my (private) website and the list is signed with my PGP key and I verified the hashes and the signature and all checked out, I am sufficiently certain that this is a false positive. None of these files have changed in the last four years, because my current software development activities are going on elsewhere.

Unfortunately there is no useful information to be had from the "details" provided by Google Safe Browsing. A full URL to the alleged malicious content would have been helpful; heck even a file name or something like MIME-type plus cryptographic hash ...

I have two pieces of content on my website where one could debate whether they are PUA/PUP (as it's called these days). Both are executables inside a ZIP file and alongside the respective source code which was used to create those executables. So in no way would any of that attempt to install anything on a visitors computer, unless we imagine a fictitious browser hellbent on putting its user at risk by requesting to run at highest privileges upon start and then unpacking every download and running found executables without user interaction. And even then one of the two pieces of software would fail and the other would be visible.

  1. One is a Proof of Concept for an exploit of Windows debug ports which has been patched for well over a decade and so will hardly be a danger to anyone.
  2. The other is a tutorial which includes a keylogger which - when run - is clearly visible to the user. So no shady dealings here either.

But since these two items came up in the past, I thought I should mention them.

Anyway, a cursory check on VirusTotal showed one out of seventy engines giving a "malicious" for my domain. Given Google bought VT some time ago, it stands to reason they use it for Google Safe Browsing.

The mysterious engine with the detection is listed as "CRDF" and I still have been unable to find out who or what that refers to. So obviously there is no way to appeal, request a review or whatever ... seems Google is judge, jury and executioner in this one.

So how do I "appeal"?

2
  • You can't. You need to add the site to the search console. But I don't think you will be giving any more data than they already have. You simply add the site and request a review. If you are concerned about connecting the site to your google account, it is easy to make a new google account for this purpose only.
    – Steve
    Mar 2 '20 at 21:50
  • @Steve thanks. Yep, I already figured that this was the only option left. The particular content they complained about was totally harmless, but whatever. I'm waiting for Google's review. Doubt, however, that there will be anything good from it. Mar 4 '20 at 7:52
2

Safe Browsing FAQs contain the following item (emphasis mine) at the time of this writing:

If my website has been compromised and is now unsafe, what can I do?

If my website has been compromised and is now unsafe, what can I do? We offer advice for webmasters whose sites have been hacked here. It’s best to register your site at Google Webmaster Tools in advance of any problems so that we can notify you promptly and provide more information about the problems we find.

If you don’t want to use Google Webmaster Tools, you can file appeals with StopBadware.org once you have removed the infection from your site. StopBadware.org also offers great resources for webmasters who want to learn more about what they can do to make their sites safer.

Their (StopBadWare) answer was unfortunately negative for me:

It looks like Google is specifically blacklisting your downloads. Unfortunately, StopBadware does not work with Google on blacklisted downloads. We have no expertise in evaluating software, and we are unable to effectively analyze executables or other files. You will have to follow these directions, if you have not already done so: https://support.google.com/webmasters/answer/168328?hl=en

I have no idea how they can tell that Google is "specifically blacklisting [my] downloads", it certainly isn't any information Google is willing to give me on its website.

Also, I would not have the slightest issue if this would only blacklist certain URLs, i.e. actual individual downloads. Instead it's blacklisting my domain and existing subdomains for no good reason.

This could be compared to closing a TV station because on someone on a talk show using a swear word. Just don't be evil, Google.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.