Id-il.com Phishing Issue

Custom Loader
1

Hi,

Is anyone else seeing a similar issue to this?

I have a custom container both on my main site and wordpress blog.

I’ve noticed Avast is blocking my blog because of a phishing detection for id-il.com.

I’ve traced the request in Chrome DevTools and the initiator chain shows it coming from my Stape custom GTM loader at gtm.organicdigital.co/62pnmnhofu.js.

The chain shown in DevTools is:

Dave Ashworth's Blog - → gtm.organicdigital.co/62pnmnhofu.js → id-il.com/embed/.../passed

Avast identifies id-il.com as URL:Phishing and blocks the request, which is preventing the page from loading correctly.

Anyone know why the Stape loader is making a request to id-il.com, and whether this is expected behaviour?

It currently appears to happen only under /blog/, which is WordPress.

But the same custom loader is used across the rest of the site without triggering the request.

2
2715×321 21.8 KB

1
1623×714 34.8 KB

2

Hi @organicdigital

The problem here isn’t the custom loader, but the fact that through your GTM container is generating a request for ‘id-il.com/embed/…/passed’, which Avast, for some reason, considers to be a phishing attempt.

In other words, there is most likely a tag in your container that is generating this request.

If you’re not sure exactly what’s triggering this request, you can pause all the tags in preview mode and enable them one by one to see which one is causing it.

3

Hi Alex,

Thanks for the reply

Figured it out, the site had been compromised and an iframe was injected into the footerr of the page

Nothing to do with GTM or Stape!

Thanks
Dave

1 Like