8 ms·
I've been complaining about this for a while. Everything I try to test with urlscan.io (as a safe sandbox to view a phishing site) has for a while just given me
by technion 3y ago
I've been complaining about this for a while. Everything I try to test with urlscan.io (as a safe sandbox to view a phishing site) has for a while just given me a Cloudflare captcha. Everything I submit to certain automated malware services just come back as "not malicious" despite being clearly malicious, I'm guessing because automation doesn't get past the catpcha.
- supriyo-biswas 3y agoI believe they simply need to integrate a captcha provider and write rules for detecting these captchas on various websites. Many scraping products and the internal scraping systems of companies (especially retailers) implement such mechanisms.
- heipei 3y agoCEO of urlscan.io here: We will be evaluating the use of captcha bypass services soon, we are fully aware of the growing problem of captchas being abused by threat actors to hide their malicious websites from automated analysis tools such as ours. It's honestly a frustrating problem as we're effectively in an arms race with the likes of Cloudflare, Google et al, and we're in the same boat with less reputable services like scrapers and bots. The recent developments around Web Environment Integrity are concerning to us for the same reasons. Feel free to reach out with any questions or suggestions you might have!
- password4321 3y agoI am not familiar with your product but that won't stop me from suggesting that maybe a Y/N API needs a 3rd answer: N/A. A captcha might serve as a strong negative signal.
- lpapez 3y agoGiven the volume of automated link scraping that you do, would it be possible for your company to arrange for a deal with Cloudflare allowing your servers past their Captcha gate, at least around the free-tier Captcha which the scammers most likely use?
- supriyo-biswas 3y agoThis right here is just such a scandal waiting to happen.
- tomklein 3y agoCheck https://docs.google.com/forms/d/e/1FAIpQLSdqYNuULEypMnp4i5pROSc-uP6x65Xub9svD27mb8JChA_-XA/viewform https://docs.google.com/forms/d/e/1FAIpQLSdqYNuULEypMnp4i5pR... (linked from https://blog.cloudflare.com/friendly-bots/ https://blog.cloudflare.com/friendly-bots/) if you didn’t already. Disclaimer: I work at CF
- lll-o-lll 3y agoSo is there a solution to this? Kind of feels like the bad guys win.
- superkuh 3y agoThe bad guys did win. Cloudflare is used by everything now. They're becoming a single point of failure.
- veave 3y agoWhy do you need a safe sandbox to view a phishing site? Afraid the site's design could hypnotise you into entering your credit card details?
- Sander_Marechal 3y agoPhishing sites are often also loaded with malware
- veave 3y agoAfraid the site's design could hypnotise you into double clicking the exe and accepting the browser's, MotW and smartscreen warning dialogs?
- nkrisc 3y agoMore worried about 0-day browser exploits. If you know a site is malicious, why risk it?
- NoobPretender 3y agoAnd the malware magically gets installed on your computer...how?
- function_seven 3y agoHere are 3 CVEs I randomly found from just this year. There are a handful of these every year. https://nvd.nist.gov/vuln/detail/CVE-2023-3079 https://nvd.nist.gov/vuln/detail/CVE-2023-3079 https://nvd.nist.gov/vuln/detail/CVE-2023-37450 https://nvd.nist.gov/vuln/detail/CVE-2023-37450 https://nvd.nist.gov/vuln/detail/CVE-2023-32439 https://nvd.nist.gov/vuln/detail/CVE-2023-32439
- iamflimflam1 3y agoI guess you've never heard of browser exploits?
- kmeisthax 3y agoThis is going to get 10x as 'fun' once Web Environment Integrity means that malware developers can demand attestation that you're a real victim and not a URL scanner
- heipei 3y agoThat is exactly my worry. It's hard enough as it is with VPN / IP detection, headless detection, Captchas, etc. WEI would probably mean game over for all but a handful of Google-sanctioned bots.