virustotal results

so every now and again i'll get an email that looks like obvious scam/whatever and every now and again i'll copy provided link and run it through virustotal just to see what it says ...(i never click on link in email )

so now my question/curiosity is , 7 or 8 or 10 vendors will flag it as phishing ect. ,does that mean the rest of the vendors that deemed link safe , is not trustworthy?
for instance the last link i ran just now , well known AV's like ESET and Kaspersky says link is safe , 10 others says its not ...
what gives ?

thanks

3nd said:

so every now and again i'll get an email that looks like obvious scam/whatever and every now and again i'll copy provided link and run it through virustotal just to see what it says ...(i never click on link in email )

so now my question/curiosity is , 7 or 8 or 10 vendors will flag it as phishing ect. ,does that mean the rest of the vendors that deemed link safe , is not trustworthy?
for instance the last link i ran just now , well known AV's like ESET and Kaspersky says link is safe , 10 others says its not ...
what gives ?

thanks

Virustotal uses 60+ antivirus engines.
Very rarely do they all agree.

What you need to look for is if the well known AV vendors, say something is safe or infected.

If vendors like Bitdefender, ESET, Kaspersky, Avira, Avast, etc., all say it's safe... it's safe.

If weirdo, hole-in-the wall companies, only... say it's unsafe... it's false positives, or geopolitical BS.

Ghot said:

Virustotal uses 60+ antivirus engines.
Very rarely do they all agree.

What you need to look for is if the well known AV vendors, say something is safe or infected.

If vendors like Bitdefender, ESET, Kaspersky, Avira, Avast, etc., all say it's safe... it's safe.

If weirdo, hole-in-the wall companies, only... say it's unsafe... it's false positives, or geopolitical BS.

thanks for clarifying
ESET and Kaspersky among others i never heard of said it's safe , then Bitdefender and some others i never heard of says its malicious , to me it looks like a roll of the dice ?
i can understand if a few well known AV's says its unsafe then its unsafe .
but this mixtures of results isn't helping if you know what i mean
personally if i see 2-3 results (no matter who it comes from) unsafe , i skip that link
plus the way the email is constructed / worded , is also a giveaway ...

3nd said:

ESET and Kaspersky among others i never heard of said it's safe , then Bitdefender and some others i never heard of says its malicious , to me it looks like a roll of the dice ?

It is just like with the food, some countries allow it, some countries ban it as carcinogenic.
Different vendors use different methodology, like Malwarebytes, it consider everything as PUP.
But to be safe, you can always use multiple browser extensions, DNS to verify. Better safe than sorry.

TairikuOkami said:

It is just like with the food, some countries allow it, some countries ban it as carcinogenic.
Different vendors use different methodology, like Malwarebytes, it consider everything as PUP.
But to be safe, you can always use multiple browser extensions, DNS to verify. Better safe than sorry.

cool
i only have Malwarebytes browser guard extension ,and defender ...
and hopefully some common sense lol

3nd said:

i only have Malwarebytes browser guard extension ,and defender ...

You could add DNS, like Cloudflare (1.1.1.2) blocking malware or Quad9 (9.9.9.9).

IP addresses . Cloudflare 1.1.1.1 docs

Windows 10 - Quad9 Documentation

took a leap and pasted link in browser to see what happens ...



so at least malwarebytes is working lol

- - - Updated - - -

TairikuOkami said:

You could add DNS, like Cloudflare (1.1.1.2) blocking malware or Quad9 (9.9.9.9).

IP addresses . Cloudflare 1.1.1.1 docs

Windows 10 - Quad9 Documentation

thanks , i'll check em out

- - - Updated - - -



ok , i'm officially using Quad9 now too , every bit helps

So I visit that page and it's blocked by a browser security add on. I unblock it and it's just a phishing site if you are dumb enough to enter personal details into it.

Callender said:

So I visit that page and it's blocked by a browser security add on. I unblock it and it's just a phishing site if you are dumb enough to enter personal details into it.

nope didn't even go there

- - - Updated - - -

the email was one of them "your package can't be delivered cause it blocked by customs " and i have to pay an amount to get it cleared blah blah blah LOL

3nd said:

nope i
the email was one of them "your package can't be delivered cause it blocked by customs " and i have to pay an amount to get it cleared blah blah blah LOL

I guessed that already because the page was something that looked like a postal service and asked for personal details.

Just for completeness. Here's screenshots with URL obfuscated.