safeonline bad website detect is weak

[apm]

it cannot detect the facebook phish website, but show "verified" which give misleading it is safe.

http://ultraxs.com/image-8C90_4AF1606A.jpg (http://ultraxs.com/share-8C90_4AF1606A.html)

[trjam]

-{ Quote: "it cannot detect the facebook phish website, but show "verified" which give misleading it is safe.

http://ultraxs.com/image-8C90_4AF1606A.jpg (http://ultraxs.com/share-8C90_4AF1606A.html)" }-
there is nothing wrong with facebook, why should it be flagged.

[firzen771]

-{ Quote: "there is nothing wrong with facebook, why should it be flagged." }-

check the URL box, thers an addition RIGHT after facebook.com

hehe i guess ur statement proves why sooo many people fall for it ;D

[apm]

just test that firefox's own anti-phish protect from it

[trjam]

I see and you are correct. I was just talking about facebook.com. It looks bad on SafeOnlines part.

[PrevxHelp]

-{ Quote: "just test that firefox's own anti-phish protect from it" }-

Could you please PM me the link? The image doesn't appear to exist anymore.

[apm]

-{ Quote: "Could you please PM me the link? The image doesn't appear to exist anymore." }-
the link is deleted, the image still there.


new phishing link: http://www.facebook.com.oooliok.me.uk/globaldirectory/LoginFacebook.php

[apm]

Prevx shows "IP not verified" what does it mean? is it unknown to prevx DB or unsafe?

http://i.imagehost.org/0893/Clipboard01.png

http://a.imagehost.org/0484/Clipboard02.png

[PrevxHelp]

-{ Quote: "Prevx shows "IP not verified" what does it mean? is it unknown to prevx DB or unsafe?" }-

It just means that the website hasn't been cross referenced yet. Less popular websites will tend to not be verified already so it may take longer for the verification to take place, however, if the website does become identified as malicious, it will be immediately blocked.

[ako]

-{ Quote: "it cannot detect the facebook phish website, but show "verified" which give misleading it is safe.

http://ultraxs.com/image-8C90_4AF1606A.jpg (http://ultraxs.com/share-8C90_4AF1606A.html)" }-

Huh! :thumbd:
I'd like to see the explanation From Prevx.

[Habakuck]

Öhm, ako, there is an explanation from Joe. :doubt: Right above you post. ::)

[ako]

No, it is not an answer to the post #1.

[papillonn]

Please don't expect everything from prevx. I just tried the link you have written above, first firefox stops me to reach it, then kaspersky link filter stops me, then comodo's secure DNS stops me to reach it and at the end there is nothing to do with prevx. Prevx is a layer in my multilayer protection. I mainly want prevx to protect my bank accounts from attacks while i browsing them, i am not obsessive about anti phishing feature of prevx. Because as Joe said "Less popular websites will tend to not be verified already so it may take longer for the verification to take place". that doesn't means every phising site would be immediately blocked, it is all about popularity imo

[ako]

-{ Quote: "Please don't expect everything from prevx. I just tried the link you have written above, first firefox stops me to reach it, then kaspersky link filter stops me, then comodo's secure DNS stops me to reach it and at the end there is nothing to do with prevx. Prevx is a layer in my multilayer protection. I mainly want prevx to protect my bank accounts from attacks while i browsing them, i am not obsessive about anti phishing feature of prevx. Because as Joe said "Less popular websites will tend to not be verified already so it may take longer for the verification to take place". that doesn't means every phising site would be immediately blocked, it is all about popularity imo" }-

The problem is: SafeOnline claims the IP is verified. Of course, the point is here, that the URL and IP match, but in this case the "verification" only mislead the potential victim. One does not need to have genius heuristics to find out that the URL is a potential phishing site.

[PrevxHelp]

-{ Quote: "The problem is: SafeOnline claims the IP is verified. Of course, the point is here, that the URL and IP match, but in this case the "verification" only mislead the potential victim. One does not need to have genius heuristics to find out that the URL is a potential phishing site." }-

The IP verification is explained in the help file and everywhere else - it is still valid to know that the phish isn't being phished :)

Phishing is harder to stop than malware - the life cycle of the average phish is around 5 hours and after they've been reported, they will generally never be used again for actually attacking a victim. We do have some phishing feeds coming in but they are almost completely irrelevant based on the volume we see and very heavily prone to FPs - therefore, we've implemented generic rules to "see" the phishes. Facebook, for instance, isn't currently covered by these rules (we are focusing primarily on banking phishes) but it can be. However, this still doesn't solve the core problem, which is solved by our credential protection.

Configuring your username/password within SafeOnline to be locked down to a specific domain will prevent any accidental phishing from taking your account information. We will immediately warn you if you are trying to enter your credentials outside of the accepted website, which prevents any phishing from taking place.

Let me know if you have any questions with this :)

[papillonn]

-{ Quote: "Configuring your username/password within SafeOnline to be locked down to a specific domain will prevent any accidental phishing from taking your account information" }-

how should i configure them?Is there any configuration?

[Habakuck]

-{ Quote: "Configuring your username/password within SafeOnline to be locked down to a specific domain will prevent any accidental phishing from taking your account information. We will immediately warn you if you are trying to enter your credentials outside of the accepted website, which prevents any phishing from taking place." }- Öhm, that still does not work for me... :-\

[PrevxHelp]

-{ Quote: "Öhm, that still does not work for me... :-\" }-

:-\ Have you tried with the newest v3.0.5.23 release? We've fixed a handful of issues with credential protection which were most likely preventing yours from working properly.

[PrevxHelp]

-{ Quote: "how should i configure them?Is there any configuration?" }-

If you visit: http://info.prevx.com/safehelp.asp and click Advanced Configuration (the last option) > Advanced Configuration Options, we've explained the advanced options + credential protection in there :)

Let me know if you have any questions!

[ako]

-{ Quote: "The IP verification is explained in the help file and everywhere else - it is still valid to know that the phish isn't being phished :)
" }-

This was a good one! :)

[Phantasm]

When it comes to bad URL's just use

MyWot.com it's the worlds best site advisor. (not including internet filters)

[Habakuck]

-{ Quote: ":-\ Have you tried with the newest v3.0.5.23 release? We've fixed a handful of issues with credential protection which were most likely preventing yours from working properly." }-
No, i didn't try it. I will do so if i find the time.

[papillonn]

-{ Quote: "If you visit: http://info.prevx.com/safehelp.asp and click Advanced Configuration (the last option) > Advanced Configuration Options, we've explained the advanced options + credential protection in there :)

Let me know if you have any questions!" }-

How can i miss this helpfull documentation! thank you :)