Google marked my subdomain (portainer instance) as a phishing website. reddit / selfhosted ---------------------------------------------------------------------- pazdikan · 2023-11-05 16:55 ​ [I've been running portainer for 1.5 years without any problems \(and without updating it\). Recently I've bought a new disk for my PI, reinstalled everything and after 2 days my portainer instance has been marked as dangerous... Tbh I don't care about my subdomain being marked as long as it's not an entire domain 💀](https://preview.redd.it /431fuyhk6kyb1.png?width=377&format=png&auto=webp&s=7d7ae6e06845875a2d 6fcd0967b62e9f898989c7) ---------------------------------------------------------------------- EndlessHiway · 2023-11-05 16:57 Why you running a phishing scam? Bad boy ---------------------------------------------------------------------- pazdikan · 2023-11-05 16:57 I've been running portainer for 1.5 years without any problems (and without updating it). Recently I've bought a new disk for my PI, reinstalled everything and after 2 days my portainer instance has been marked as dangerous... Tbh I don't care about my subdomain being marked as long as it's not an entire domain 💀 PS: There was some kind of a form in which I said it's a commonly selfhosted software, posting this because I don't see that happening very often and it's kinda funny ---------------------------------------------------------------------- pazdikan · 2023-11-05 17:03 \[you got me\](https://giphy.com/gifs/walter-white-y6Inkaz7omxAk) ---------------------------------------------------------------------- EagerDevourer · 2023-11-05 17:11 It happens systematically with portainer in my experience. You appeal with Google, and they just let it go instantly. ---------------------------------------------------------------------- pazdikan · 2023-11-05 17:20 I've never updated it, probably that's why it got marked now after I've installed the latest version. I guess I already appealed unless the form from a link on that big red warning screen wasn't the actual appeal (there was a single optional text box, that's the only thing I remember haha) ---------------------------------------------------------------------- DearBrotherJon · 2023-11-05 17:30 This literally happen to me yesterday. I filled out that same one text box appeal form and it was resolved within a a couple of minutes. ---------------------------------------------------------------------- starbuck93 · 2023-11-05 17:30 Are you using Cloudflared by chance? In any case, just fill out the form to appeal it. This happened to me this year and it took about a day or two for them to resolve it. You can also add your domain to the Google Search Console to help protect it from this in the future. ---------------------------------------------------------------------- lucassou · 2023-11-05 17:52 I've had this issue for a few of my subdomain, I figured google doesn't like when the domain starts with a popular service name without actually being the official page. You can just report this as a false positive and they remove the warning. ---------------------------------------------------------------------- jkirkcaldy · 2023-11-05 18:17 If you’re exposing portainer to the internet you should absolutely be keeping it up to date!! It’s less of an issue if it’s locked behind a vpn ---------------------------------------------------------------------- lllllllillllllillll · 2023-11-05 18:24 Are you still using the default self-signed certificate it comes with? Did you put anything in front of it, like fail2ban or crowdsec? Typically applications you use to manage your server shouldn't be exposed to the internet like that. ---------------------------------------------------------------------- tquinnelly · 2023-11-05 18:53 Not sure I’d expose it to the world ---------------------------------------------------------------------- pieman3999 · 2023-11-05 19:25 I kept getting this on a number of my sub-domains. Even filling in the Google form, the warning was removed for a few days before reappearing. I ended up putting a Traefik Forward Auth page in front which has prevented more warnings appearing. ---------------------------------------------------------------------- realdealrd · 2023-11-05 19:52 If you are using a Cloudflare tunnel to access portainer, I have noticed some false alarms for both detection on my apps. Maybe this could be related to that. Good reminder (at least for me) that cloudflare can see modify all traffic ---------------------------------------------------------------------- Scavenger53 · 2023-11-05 20:00 why would you ever expose portainer, which has root access to your system, to the internet? ---------------------------------------------------------------------- Veloxy · 2023-11-05 20:30 I had this happen with a subdomain that was never even exposed to the web, only accessible through Tailscale. ---------------------------------------------------------------------- baggar11 · 2023-11-05 20:59 Happened to me a couple weeks ago. I used these 2 Google sites to figure out what/why they were marking as phishing and scamming. I had to update my DNS record and then requested an appeal. Issue went away after 2-3 days. All in all, I never changed a thing on my site(s). Just a random bot doing their job apparently. https://search.google.com/search-console/welcome https://transparencyreport.google.com/safe-browsing/search ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-11-05 21:36 I just disallow crawlers on my domain and have almost anything behind 2fa ---------------------------------------------------------------------- ZaxLofful · 2023-11-05 21:44 Why are you exposing Portainer to the internet? ---------------------------------------------------------------------- ohv_ · 2023-11-05 21:59 All mine are. I don't see a problem with it. Good password, 2fa, acls. ---------------------------------------------------------------------- J_aie_Joe · 2023-11-05 22:32 Happened to me also. After few years got flagged. I appealed and it was resolved under few days. I didn’t know it was Portainer related though as everything I am using is behind a reverse proxy. If anything I thought it was my nginx reverse that was the problem. Anyway after the appeal everything is smooth now. ---------------------------------------------------------------------- Chameleon3 · 2023-11-05 22:34 I had this the other day.. With a domain that points to a private address, not accessible externally in any way, which got me really confused. Couldn't find any way to fight it, but someone said to fully restart chrome and.. That worked. Haven't seen it again since. ---------------------------------------------------------------------- wmantly · 2023-11-05 22:34 Google does this with my self hosted services every once in a while, mostly with Emby and Gitea. It uasly goes away after a day or 2. ---------------------------------------------------------------------- AfterShock · 2023-11-05 23:26 Not instantly, it takes a few days for sure. ---------------------------------------------------------------------- -pLx- · 2023-11-05 23:29 What about cloudflared tunnels that require google login to access the subdomain? Any idea how safe that is? ---------------------------------------------------------------------- -pLx- · 2023-11-05 23:30 To fix shit when you’re not at home? ---------------------------------------------------------------------- machstem · 2023-11-05 23:32 Then you expose a VPN and/or zero trust endpoint, you don't typically expose anything from a management perspective. ---------------------------------------------------------------------- -pLx- · 2023-11-05 23:39 How do we know that domain is not exposed via cloudflared + zero trust? Isn’t the way they expose it more important than whether they expose it or not? ---------------------------------------------------------------------- ExperimentalGoat · 2023-11-05 23:49 What do you use for 2fa? Something like Authentik or 2fa built into specific containers? ---------------------------------------------------------------------- XTJ7 · 2023-11-05 23:54 Safer, but that's still not magic and depending on the typa and severity of the security issue, you might still be vulnerable. Just keep it up to date when you have it facing the internet. ---------------------------------------------------------------------- -pLx- · 2023-11-05 23:54 Gotcha, thank you! ---------------------------------------------------------------------- Scavenger53 · 2023-11-06 00:07 ssh tunneling bro ---------------------------------------------------------------------- -pLx- · 2023-11-06 00:19 Isn’t exposing the container’s port to a cloudflared tunnel and then protecting it with zero trust just as safe? Genuinely curious, I’m far from an expert and I had always considered that to be a relatively safe setup, since you’re not opening any ports on your router and you’re not bound to any IP address people can target directly without going through Zero Trust first ---------------------------------------------------------------------- returnofblank · 2023-11-06 00:29 I assume it's because you put a specific name of a service in the subdomain, I've had the same issues after I put "jellyfin" in my subdomain You can submit an appeal to get it fixed, worked for me 2 times ---------------------------------------------------------------------- hatcod · 2023-11-06 01:10 You don't need to expose anything for this to happen, Chrome's data collection is how they detect this stuff, they're not crawling the internet. ---------------------------------------------------------------------- EagleLeft5225 · 2023-11-06 01:17 Happened to a deployed internet device my customer has. It is up-to- date and no other similar device has been marked. I tried to report it false positive but nothing came out of it. Still marked to this day. ---------------------------------------------------------------------- Quique1222 · 2023-11-06 01:44 Why not? What's the problem with exposing portainer behind s reverse proxmox and LDAP authentication? Serious question ---------------------------------------------------------------------- DazzlingTap2 · 2023-11-06 02:06 Had the same happen to my [Bookstack site](https://www.reddit.com/r/Bo okStack/comments/112nnwe/my_personal_bookstack_wiki_is_marked_as_decep tive/), as well as my fireshare site. Nothing you can do about it, except appeal to Google. For me, it went away in 8 hours after I appealed. That's the frustrating thing, google or other platform do their blackmagic and you have no control and solutions except praying it doesn't happen to you. ---------------------------------------------------------------------- lgats · 2023-11-06 02:20 give it a search at https://phishtank.org/ ---------------------------------------------------------------------- ZaxLofful · 2023-11-06 02:48 Any additional open ports exposes you to vulnerabilities, be they old or zero-day. Best practices says, that management interfaces like this should never be exposed to the public internet. Either a private VLAN or a VPN + whitelist are the two options most used these days. I’m seeing a lot more people using Tailscale for this in the last year or so, to the point where I have switched to Firezone, half way there, from just regular WireGuard. At a minimum I recommend allow lists, because then external state hackers have no chance at all. ---------------------------------------------------------------------- KN4MKB · 2023-11-06 02:49 Had this pop up before. 1. Don't visit your self hosted instances on Google Chrome. This is how this happens because chrome scans the websites and detects it is like many others . 2. You're gonna have to send a lot of emails out. Scan the domain on virus total, and just email every flagged vendor and explain to them the situation. It takes a week or so, but you'll eventually clear the name. 3. Just don't expose portainer externally. There actually no reason for it. That's just the most basic foundation of security. ---------------------------------------------------------------------- theiam79 · 2023-11-06 03:58 I host various services behind an nginx proxy. Put in an appeal and waited a few days - they cleared it up. I didn't change anything, and haven't had a problem since \*knocks on wood\* ---------------------------------------------------------------------- Scavenger53 · 2023-11-06 05:05 not sure, all my stuff is on my hardware in my living room ---------------------------------------------------------------------- euri10 · 2023-11-06 05:37 It happened to me last month on all my subdomains, I appealed and it was removed in a day. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-11-06 06:23 I use authelia/authentik and have portainer deployed with oauth ---------------------------------------------------------------------- MERKR1 · 2023-11-06 08:26 This ---------------------------------------------------------------------- sufyaann · 2023-11-06 08:54 I can solve your issue and google will remove the phishing lable from your subdomains. It comes due to some malicious files in your hosting ---------------------------------------------------------------------- jdigi78 · 2023-11-06 11:53 Happened to me with my bitwarden instance. Just had to appeal it and wait a day or 2. Try to keep software names out of your URL ---------------------------------------------------------------------- 404invalid-user · 2023-11-06 12:42 Same for my pi hole I have dns.domain point to a local ip and Google didn’t like that reported it and no longer get that issue ---------------------------------------------------------------------- nikoelectrico · 2023-11-06 13:49 use Wireguard for accessing portainer plz ---------------------------------------------------------------------- DerryDoberman · 2023-11-06 13:53 Why are people downvoting this so hard? There seems to be this assumption that portainer will habe some autentication bypass that will grant admin/root access but the same could be postulated about any exposed service, including VPNs or SSH services. 2FA is very sufficient in my opinion, even for something like portainer. Everything exposed on my network is firewalled off to only the specific services and ports needed so even if they're compromised they can't get anywhere. Ultimately this is all risk/benefit. Exposing services has some level of risk which can be reduced by motivations (2fa/acls) and people are allowed to make their own decision/assessment on if that's sufficient. ---------------------------------------------------------------------- FollowTheTrailofDead · 2023-11-06 16:52 This happened to me 3 times.. the third time, I de-registered all my subdomains and set up a subdomain global forwarder... Every request gets forwarded to caddy. A lot easier just adding subdomains to caddy and since my main top domain and www both error out, no more Google blocks either... ---------------------------------------------------------------------- elliot_n00b · 2023-11-06 17:45 +1 for tailscale ---------------------------------------------------------------------- Frooastside · 2023-11-06 20:04 I noticed this happening to a lot of my domains but only if I requested a SSL certificate from let's encrypt you can try using a wildcard certificate in the future, that worked for me (appealing also works every time but can get annoying) ---------------------------------------------------------------------- async2 · 2023-11-06 21:42 Because it's mainly unnecessary to give it access from the web. It's not a public facing service. ---------------------------------------------------------------------- PrplPistol · 2023-11-18 07:45 It happened to me and it was completely local. Google doesn't seem to get the info exclusively from the Internet. ---------------------------------------------------------------------- ZaxLofful · 2023-11-18 07:53 I don’t use Chrome, so that explains it ---------------------------------------------------------------------- PrplPistol · 2023-11-18 07:54 Ah, yeah that makes sense. I've never had any issues with Firefox so far.