I was just trying to access one of the services I host when I'm hit with a full red error page on Brave saying:<p>> Deceptive site ahead<p>> Attackers on code.nickthesick.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards).<p>With a "Learn more" link which gave me a link to: https://support.google.com/chrome/answer/99020?visit_id=637947814277802266-3335630021&p=cpn_safe_browsing&hl=en&rd=1 which had a section:<p>> My site or software is marked dangerous or suspicious<p>> Site owner: If you own a site marked as dangerous or deceptive: Follow the instructions [to fix the problem and request a review](https://developers.google.com/webmasters/hacked/docs/request_review).<p>Linking to: https://web.dev/request-a-review/
Which is now taking me through the process for requesting a review from Google.
So now I'm verifying myself to Google that I own the domain to even see what my domain was flagged for.
This takes adding a TXT record, so off to Cloudflare to update my DNS records.
After verifying that I own the domain, and looking for the issue, all I get is:<p>> 1 issue detected<p>> Google has detected harmful content on some of your site’s pages. We recommend that you remove it as soon as possible. Until then, browsers such as Google Chrome will display a warning when users visit or download certain files from your site.<p>and:<p>> Description: These pages attempt to trick users into doing something dangerous, such as installing unwanted software or revealing personal information. Learn more<p>> Sample URLs: N/A<p>It can't even bother to tell me which page is trying to "trick users into doing something dangerous, such as installing unwanted software or revealing personal information". What a sham, looking into the Learn More link:<p>> Most reconsideration reviews can take several days or weeks, although in some cases, such as link-related reconsideration requests, it may take longer than usual to review your request.<p>Whaaa? You are blocking my site for days to weeks without giving me any information on what the issue is or even where it is?<p>I seriously don't know what my domain could have been flagged for, the main site `nickthesick.com` is just a personal page that I wrote up on my own.
The other sub-domains host several selfhosted services that I run for personal use and would find it weird for any of them to even be indexed by Google much less flagged by it.<p>Maybe it is one of the services? But all of them are open source I think.<p>Has anyone else ran into this issue? What did you do?
I'm tempted to just ask them to review it because I don't know what could even be flagged but I'm afraid that they will give me trouble for it later if they find the same 'deception' again.
VirusTotal has two engines flagging it, one as phishing, one as malicious. [1] It appears someone / something triggered a scan for this domain a while ago in urlscan [2] There may be a reference to <a href="http://127.0.0.1/" rel="nofollow">http://127.0.0.1/</a> in part of your site [3] which could trigger a rebinding attack warning but it isn't clear if that is an issue. Your domain does not show up in SafeSearch so I would assume Google is querying 3rd parties like VirusTotal/urlscan.<p>One of the sites you link to also shows up as malicious. [4] Consider removing that link and then scan your site again in VirusTotal to see if there is any improvement.<p>[1] - <a href="https://www.virustotal.com/gui/url/c4e3735d039799592ba8df128350c7b17039321561fa5c4408ce7793af30405d?nocache=1" rel="nofollow">https://www.virustotal.com/gui/url/c4e3735d039799592ba8df128...</a><p>[2] - <a href="https://urlscan.io/result/66f0c672-9eb2-4d62-8076-80b928862d7d/" rel="nofollow">https://urlscan.io/result/66f0c672-9eb2-4d62-8076-80b928862d...</a><p>[3] - <a href="https://urlscan.io/result/66f0c672-9eb2-4d62-8076-80b928862d7d/#transactions" rel="nofollow">https://urlscan.io/result/66f0c672-9eb2-4d62-8076-80b928862d...</a><p>[4] - <a href="https://www.virustotal.com/gui/url/a06524a44c45bec7ed62087b322239f722098b75e8113c0360850165c8b76bb3?nocache=1" rel="nofollow">https://www.virustotal.com/gui/url/a06524a44c45bec7ed62087b3...</a>
I had this once happen to me when I hosted an executable file for direct download from the same IP serving the website. For some reason, Google thought the executable was malicious and flagged the domain for hours until I removed that particular file.<p>I hope this helps.