False Positive [www.yasir252.com]

[MagicalAlchemist]

Link : www.yasir252.com

I think it makes more sense to go into a piracy blocklist than into a malware / ads and tracker blocklist.

[hagezi]

Yes. ;)

[hagezi]

Fixed.

[MagicalAlchemist]

nice, thank you.

[MagicalAlchemist]

@hagezi can you unblock this one more time?

[iam-py-test]

This appears to come from my blocklist (though also a few others), so I'll look into unblocking

[iam-py-test]

Short answer: I'm hesitant to unblock it, but so far I don't see any evidence the site it's self is malicious. However, it does host quite a few malicious ads.
Long answer:
The site's a complete adwall and I spent half my time clicking fake download buttons before I found the real one^[1].
The file I downloaded claimed to be Glasswire (which was what I tried to download). However, while I did get a Glasswire setup window, I did not ever end up with it installed. Instead, I ended up with what acted like malware ^[1]. Oddly, that executable does appear to be the legitimate Glasswire ^[2]. In fact, it is identical to version 2.3.449 from the legitimate Glasswire website. The "crack" DLL included gets 0 detection on VT^[3], and without any evidence to the contrary (and I lack the skills to reverse engineer it), I must assume it too is safe. Both with and without that DLL, it seems to install a legitimate (but broken) version of Glasswire^[4]. It seems that the Glasswire installer tries to fingerprint the machine it's running on, which is sketchy, however, given that this occurs with just the plain exe installed - which is signed and identical to the one from the website for that version - I guess this is just Glasswire.
This website is blocked by the notracking list (though I am unsure why, and given it is currently unmaintained^[5], I wouldn't decide based on that factor alone) and detected by 8 engines on VT ^[6].
In my opinion, it's not a site I would personally trust (even with a content blocker installed). However, I have commented out the entries blocking it in iam-py-test/my_filters_001@f0dcafa. If someone can provide more evidence either way, then I will either remove it completely or reblock it.