Google somehow has access to my local Proxmox instance (not port forwarded), and labels it as phishing reddit / selfhosted ---------------------------------------------------------------------- ExperienceKnown · 2023-12-25 17:32 Hi all, I have a simple \*.eu.org subdomain which has a proxmox subdomain with an A record pointing to, you guessed it (or not ;) ), [192.168.1.211](https://192.168.1.211) . I am using the subdomain so I can use WebAuthn with my instance, and have simpler wildcard certificates. I issue them out myself from my own CA (yes, I know there are easier ways to do stuff like this like Let's Encrypt...) Well, I was greeted with this about 5 minutes ago: ​ [Upper right corner - Certificate is valid Main: Dangerous website - Attackers on this website can get you to install software or reveal your password.....](https://preview.redd.it/lm1gsah37h8c1.png?width=19 20&format=png&auto=webp&s=2c5e598c8d5983733df77e7c0d043b65539c99ce) ​ [WebAuthn no longer working, TLS certificate error \(upper image, Certificate is valid??!!\)](https://preview.redd.it/f90yg4le6h8c1.png? width=1920&format=png&auto=webp&s=96e4d4e708d96179ffeb5a913a045b989278 4d69) I have tried my other subdomains that work fine, so trouble is in this subdomain. What can I do to stop reading Dangerous every-single-time I want to open my panel, and IMO more interesting, how did Google come to the conclusion that something they can't even access is dangerous? Sadly I am stuck with Chrome since Mozilla doesn't have some extensions that I need. What is even going on in here? Is Chrome scanning websites from my PC (basically spying on me IMO)? Thanks in advance! ---------------------------------------------------------------------- shatirati · 2023-12-25 17:46 Are you surprised that chrome is spying on you? You can try brave browser based on chromium and it runs chroms add-ons ---------------------------------------------------------------------- Other-Technician-718 · 2023-12-25 18:02 Is it a public DNS server where ypu have that A record set? ---------------------------------------------------------------------- mistersinicide · 2023-12-25 18:10 You state that you have a wildcard for \*.eu.org, this would only be valid for domains like [domain1.eu.org](https://domain1.eu.org) [domain2.eu.org](https://domain2.eu.org), not valid for [subdomain.domain1.eu.org](https://subdomina.domain1.eu.org), you'd need something like \*.domain1.eu.org and so on, this is because wildcards are at specific levels. ---------------------------------------------------------------------- undefined-one · 2023-12-25 18:10 Please explain how Brave does not do the same ---------------------------------------------------------------------- meddig0 · 2023-12-25 18:20 Happy to be corrected, but it may be something to do with your self- signed certs. If they can't be authenticated against a known CA, or they don't contain all of the right info, you'll see a warning. For example, we had an issue at work when Edge changed their policy on requiring SANs in the certs and we had to get them added in. This is whereas you mentioned, Let's Encrypt is so helpful. Trusted CA and contains all the required info. Plus it auto-renews which is far too useful, imo. ---------------------------------------------------------------------- Original_Bend · 2023-12-25 18:22 You go read their doc instead, it’s way more thorough. ---------------------------------------------------------------------- user3872465 · 2023-12-25 18:24 Theres nothing preventing you to set a private IP for a global DNS Server. There is no spying going on. If you set that record it will reslove to the local IP. SO it does not mean anything as that local IP is as the name implies LOCAL, so it will only resolve to the IP of your Proxmox for you in your home. It lables it as phishing as you use a public Domain which is not yours, nor is it a local domain suffix. So chose a different domain you own, or one that is local. and .local is not local as thats used in mDNS. ---------------------------------------------------------------------- SlimeCityKing · 2023-12-25 18:24 You receive a different warning for self-signed certificates, this one is specifically for Googles safe browsing or whatever. Op likely has his Proxmox exposed somewhere ---------------------------------------------------------------------- meddig0 · 2023-12-25 18:26 Aaah ok. I've never bothered with one so I've not seen this warning before. Thank you for the info :) ---------------------------------------------------------------------- SlimeCityKing · 2023-12-25 18:32 Yea Ive gotten it on my Jellyfin before and it was annoying to get rid of. But if OP has it on proxmox thats a huge issue somewhere. ---------------------------------------------------------------------- AnApexBread · 2023-12-25 18:36 Google doesn't have access to your Proxmox domain. Chrome sees you trying to go to a website and sees that the x509 cert CN doesn't match the URL you typed in. So it's throwing a warning ---------------------------------------------------------------------- katrinatransfem · 2023-12-25 18:40 I had that with my PiHole a few months ago, also not publically accessible. I appealed it, and they removed it about a day later. ---------------------------------------------------------------------- Valuable-Question706 · 2023-12-25 18:41 See [https://support.google.com/webmasters/answer/6347750?hl=en](https ://support.google.com/webmasters/answer/6347750?hl=en) ​ > Is Chrome scanning websites from my PC (basically spying on me IMO)? I would not be surprised if they would be caught doing this one day. Anyway, you can always turn off 'Safe browsing' feature, if it fits your habits and you understand of basic security principle. ---------------------------------------------------------------------- nitsky416 · 2023-12-25 18:51 If you're using a public DNS to resolve a LAN IP, it looks to google like you're accessing a botnet drone on your LAN that's going to steal your info. I doubt very much they flagged your domain specifically or that it has anything to do with ProxMox. Get your internal DNS to resolve the subdomain or something and see if it makes a difference ---------------------------------------------------------------------- ExperienceKnown · 2023-12-25 19:07 Yes. ---------------------------------------------------------------------- Other-Technician-718 · 2023-12-25 19:11 Google does not have access to your local proxmox instance, you tell the whole world about it. That record is visible to anyone. And as it is not routable in the public intemet (RFC1918) it may get flagged by everyone. Put that record on your own DNS server (that is not public) or in your hosts file. ---------------------------------------------------------------------- Chameleon3 · 2023-12-25 19:12 Had this on a local domain, only accessible on my lan. After trying multiple things a hard restart of Chrome actually fixed it, just fully closing the process and starting Chrome again and it was seemingly gone. Just in case you haven't tried that, you should. Took me an hour of googling and debugging before I thought to even try that ---------------------------------------------------------------------- ExperienceKnown · 2023-12-25 19:14 Hi, I have checked again with MXToolbox and they prove my opinion: the A record is [192.168.1.211](https://192.168.1.211). Type Domain Name IP Address TTL A proxmox.hidden.eu.org 192.168.1.211 60 sec Also, checking my router settings, I only have the port 4589 UDP forwarded for WireGuard. I don't have any tunnels or similar. So I doubt I have a exposed instance..., should I look somewhere else? P.S.: on another subdomain I have an A record pointing to my home IP. Is that insecure (used for WireGuard)? ---------------------------------------------------------------------- SlimeCityKing · 2023-12-25 19:26 So I think you have a couple options here. The first is not use public DNS servers for local DNS. Theres really no reason why you can't do that, however, it does mean Google can flag your domain name for whatever reason. If you do insist on using public DNS servers for local resolution what you can do is add it to your Google account and submit a request to Google to take off the warning. I have had to do that a few times for my Jellyfin instance. >on another subdomain I have an A record pointing to my home IP. Is that insecure No necessarily, as long as you know the implications of that and are confident you have proper security on any exposed service. ---------------------------------------------------------------------- ExperienceKnown · 2023-12-25 19:42 Thank you! ---------------------------------------------------------------------- ExperienceKnown · 2023-12-25 19:44 Thank you for your input! Seems as if you are correct, I have just completley restarted Chrome and voila, it works OK now! Sometimes the stupidest idea is the correct one ;) ... ---------------------------------------------------------------------- wedeservethis · 2023-12-25 19:54 You have correct answers in the replies. Read them. ---------------------------------------------------------------------- KrazyKirby99999 · 2023-12-25 22:30 Yes, Google checks your browsing history for "security". Use a Chromium-based browser such as Brave to keep your browser extensions while also being allowed to access your instance. ---------------------------------------------------------------------- NikStalwart · 2023-12-26 00:02 > Sadly I am stuck with Chrome since Mozilla doesn't have some extensions that I need. Mozilla uses the same webextensions API as Chrome. The only difference is that Mozilla uses the browser.* namespace whereas chrome uses, you guessed it, chrome.*. So you can reuse your Chrome extensions at will. > Google somehow has access Google has access because Chrome sends telemetry to Google. If you want to avoid it, try Chromium. Google checks certain heuristics and really, really does not like management control panels hosted on local network addresses. Perhaps it thinks someone is doing dodgy CSRF? Anyway, this issue is brought up every few weeks on this subreddit, and the general consensus is to go to Google Safebrowsing and file a false positive. It may also help to register your domain with Google Search Console et al, that helps with its reputation, even if you don't use search. ---------------------------------------------------------------------- MeudA67 · 2023-12-26 01:41 I've been flagged a few times like this... You have to go to Google's search console (https://search.google.com/search- console/welcome?utm_source=about-page), claim your domain, and report it as a false positive. Wait about 48 hours and you'll be ok. Now...what I think solved this issue long term for me... Avoid urls containing the real names of the services (i.e. Proxmox.me.com) I think this will make your site flagged as trying to impersonate the real website, steal information,etc. I renamed all my subdomains to the 2 first letters of the service, like co.xx.com for Cockpit, ra.xx.com for radarr, etc, and haven't had the issue since. 100% my theory...I may be completely wrong, but so far so good! ---------------------------------------------------------------------- Linux-Human · 2023-12-26 09:26 Not sure if this would help but I wonder if using chromium would give a different result? ---------------------------------------------------------------------- Frooastside · 2023-12-26 11:28 I noticed that for me it only happens if the SSL certificate was specific and included "brands", like "proxmox". If I used a wildcard certificate which then didn't include those words it was never flagged in two years now. But you can easily report it as invalid and they will remove the warning. ---------------------------------------------------------------------- ExperienceKnown · 2023-12-26 13:22 Sorry, I meant to say I have a wildcard certificate for *.hidden.eu.org . The certificate works fine in Chrome, though I do have some quirks on Firefox with it. Thanks for your input. ---------------------------------------------------------------------- ExperienceKnown · 2023-12-26 13:24 Thank you for your input! I will try the things you have mentioned.