• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos1 Stats

The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Technical Issue:

I opened a new Firefox private browsing window. I accessed my Gmail account. I opened an email I received. I clicked on a link in the email. A new tab opened displaying the URL https://my.anglr.tech/register in the address bar. The Safe Web icon displayed in the tab's toolbar was a white check mark enclosed by a green square. The icon indicates the URL is safe. I opened a new Firefox tab in the same window. I manually entered the URL https://my.anglr.tech/register into the address bar and pressed <Enter>. Firefox displayed the same web page as that displayed when I clicked the email link, but the Safe Web icon for the tab was the white question mark enclosed by a grey square. That icon indicates the URL is untested. This didn't make sense. Both browser tabs displayed the same web page, but displayed different Safe Web icons, i.e. different site ratings.

I then opted to use the Norton Safe Web site to verify the rating for the https://my.anglr.tech/register URL. I opened a new tab in the Firefox browser window, entered the URL safeweb.norton.com in the address bar, and pressed <Enter>. The Norton Safe Web homepage was displayed. In the enter site address field, I entered the URL https://my.anglr.tech/register, and then pressed <Enter>. The browser tab displayed the Safe Web Report for anglr.tech. Its rating was untested.

I went back to the email and hovered the mouse pointer over the link in question. The URL displayed in Firefox's link status bar was not https://my.anglr.tech/register. Rather, the URL started with http://e.customeriomail.com. I right-clicked on the link and selected the Copy Link Location entry from the displayed menu. The URL copied was http://e.customeriomail.com/e/c/eyJlbWFpbF9pZCI6IlJLSEZCQU1BQVc1bWRvT1ZR....

I returned to the browser tab connected to the Norton Safe Web site and clicked the Home link to return to the Safe Web homepage. I then pasted the copied link into the enter site address field and pressed <Enter>. The browser tab displayed the Safe Web Report for customeriomail.com. Its rating was safe.

Why am I seeing different Safe Web icons in Firefox's toolbar, i.e. different site ratings, depending on whether the site arrived at was initiated by clicking on an email link or manually entering the URL? Ultimately, both methods arrive at the same web page.

Date Identified: 11/15/2019

Norton product: Norton Safe Web browser extension for Firefox, Version: 3.10.1.2

Operating System: Windows 10, Version: 1903, OS build: 18362.476

Steps to reproduce issue: See Technical Issue section above.

Thank you for your help with this matter.

Replies

Kudos1 Stats

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

http://e.customeriomail.com/e/c/eyJlbWFpbF9pZCI6IlJLSEZCQU1BQVc1bWRvT1ZRWHgtc3hLeHloZ3pFdz09IiwiaHJlZiI6Imh0dHBzOi8vYXBwLmFkanVzdC5jb20vcGlmcXJwNj9mYWxsYmFjaz1odHRwcyUzQSUyRiUyRm15LmFuZ2xyLnRlY2gvcmVnaXN0ZXJcdTAwMjZ1dG1fY2FtcGFpZ249RmlzaGluZytJbnRlbGxpZ2VuY2UrTmV3c2xldHRlcistKzExJTJGMTNcdTAwMjZ1dG1fY29udGVudD1GaXNoaW5nK0ludGVsbGlnZW5jZStOZXdzbGV0dGVyKy0rd2Vla2x5K3VwZGF0ZVx1MDAyNnV0bV9tZWRpdW09ZW1haWxfYWN0aW9uXHUwMDI2dXRtX3NvdXJjZT1jdXN0b21lci5pbyIsImxpbmtfaWQiOjM0NzAsInBvc2l0aW9uIjoxfQ/a2e8426a4e87636e410090f7e7a112f5eaca49a2af72d6a43ad28532a3b3f8f9

lands on

https://my.anglr.tech/register

https://safeweb.norton.com/report/show?url=http://e.customeriomail.com/e/c/eyJlbWFpbF9pZCI6IlJLSEZCQU1BQVc1bWRvT1ZRWHgtc3hLeHloZ3pFdz09IiwiaHJlZiI6Imh0dHBzOi8vYXBwLmFkanVzdC5jb20vcGlmcXJwNj9mYWxsYmFjaz1odHRwcyUzQSUyRiUyRm15LmFuZ2xyLnRlY2gvcmVnaXN0ZXJcdTAwMjZ1dG1fY2FtcGFpZ249RmlzaGluZytJbnRlbGxpZ2VuY2UrTmV3c2xldHRlcistKzExJTJGMTNcdTAwMjZ1dG1fY29udGVudD1GaXNoaW5nK0ludGVsbGlnZW5jZStOZXdzbGV0dGVyKy0rd2Vla2x5K3VwZGF0ZVx1MDAyNnV0bV9tZWRpdW09ZW1haWxfYWN0aW9uXHUwMDI2dXRtX3NvdXJjZT1jdXN0b21lci5pbyIsImxpbmtfaWQiOjM0NzAsInBvc2l0aW9uIjoxfQ%2Fa2e8426a4e87636e410090f7e7a112f5eaca49a2af72d6a43ad28532a3b3f8f9


and

https://my.anglr.tech/register

lands on

https://my.anglr.tech/register

https://safeweb.norton.com/report/show?url=https://my.anglr.tech/register


> How to post an image in the forums.

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Kudos1 Stats

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

IDK

I've seen similar before.  I pay attention to URL in the Safe Web dialog. 
that seems to be what Safe Web reports on and as you've observed not the URL in the address bar. 

Maybe, the URL that causes the page call is what Norton sees and reports on regardless of where the call lands.

Although, on a redirect I imagine we'd want Norton to report on where the call lands. 
 

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Okay, maybe here's an example... or, maybe not. 
I email'd myself a link to a known block'd web page.
I click on the email link and see >

and then I click > Continue Without Isolation Mode (above) > and see

and then I click > Continue to the site (above) >  and see
Now, I start over and click on the same email link and Sign In to activate Isolation Mode.

then I see

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Thank you bjm_.

Maybe, the URL that causes the page call is what Norton sees and reports on regardless of where the call lands.

Although, on a redirect I imagine we'd want Norton to report on where the call lands.

In your last reply, you indicated "Although, on a redirect I imagine we'd want Norton to report on where the call lands." How can I find out from Norton if this is as designed, or is a bug?

Thanks.

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

I'll imagine Safe Web reporting is influenced by call n' land variables.

Maybe, you can pursue > Chat with Official Norton Support   --|-- Call Official Norton Support .

I doubt Support will pursue without seeing as you're seeing, first hand.

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Thank you bjm_ for your email link example, but I don't believe it emulates the issue I initially reported. This is because the link in the email is the URL of the dolphin.cash site. If it were to emulate my issue, the URL of the email link would have to be different than the dolphin.cash URL; but when clicked would ultimately result in a browser opening the dolphin.cash site.

That being said, I am glad you presented the example, as I was introduced to the 'Isolation Mode' feature. I did not know this feature existed. I don't ever recall seeing it before. Is this feature available in all Norton 360 plans?

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

What is web Isolation Mode?
https://support.norton.com/sp/en/us/norton-identity-safe/current/solutions/v127606124

FAQ: Online Banking Protection
https://support.norton.com/sp/en/us/norton-identity-safe/current/solutions/v131585157

Protect your browsing experience using Link Guard
https://support.norton.com/sp/en/us/norton-identity-safe/current/solutions/v130461421

Thank you bjm_ for your email link example, but I don't believe it emulates the issue I initially reported.

Yes....does not emulate as initially reported.  

That being said, I am glad you presented the example, as I was introduced to the 'Isolation Mode' feature. I did not know this feature existed. I don't ever recall seeing it before. Is this feature available in all Norton 360 plans?

feature is thru Norton Safe Web browser extension 'page block' > 'Continue to the site'

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Continue to the site =
Continue Without Isolation Mode =


Sign In =
Sign In = dophin.cash Isolation Mode

user Signed in as: at Safe Web Settings
Note: Signed in as: survives browser cycle.

Kudos1 Stats

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Well, I chatted with Norton Support. At the end of 1 hour and 20+ minutes, I did not get an answer to my question: why does the Norton Safe Web icon in the Firefox toolbar display a rating for a site different from that displayed in the Firefox address bar. The great majority of the 1 hour and 20+ minutes was spent trying to explain my issue to the Norton Support representative.

At the very beginning of my chat with the Norton support representative, I indicated that this Norton Community Forum post should be read to understand my issue. Despite providing that information, I was asked multiple questions, the answers to which would have been clearly evident, if the Norton support representative have read the first reply to this post.

I indicated my issue was easily reproducible, as shown in the first reply to my post. I asked the Norton Support representative to reproduce my issue. I was told: “We at Norton can only open Norton websites. As the website is not of Norton, we cannot open it from our end. We have restrictions to open only Norton websites.” I asked if this is because of security risks. The Norton support representative answered: “Yes, we are restricted to only Norton websites due to security purpose.” I find that answer disturbing. It makes me question how much Norton trusts its own tools.

Later in the chat, I was told: "The issue seems not related to Norton but the link might be designed in such a way that it shows different URL and different name. I would suggest to contact that website support team to check why it shows different name and link." I responded that I was very disappointed, and that I most definitely believed it was a Norton Safe Web issue.

I asked if there was any other way for me to have Norton evaluate my issue, e.g. email? The question went unanswered. Instead, I was told: “if the issue was due to Norton, you should not get different URL after clicking on any specific website address... if the issue is related to Norton, you can uninstall Norton and then check if you still get different URL in the address bar and if yes, then the issue is not related to Norton.”

I tried to explain the issue one last time. The reply was: “I would suggest to submit your feedback to Norton Safe Web team from your end and you will get a reply from them.” I asked how to do that. The reply was: “You can open https://safeweb.norton.com/ link and then put the website URL and then sign in. Then you will get an option to submit your feedback. You can also submit to Norton Community forum using the thread you have earlier provided.” The support representative then added, “I'm sending you an email so please reply to our email and attach the screenshot of the website which shows different link in browser and different website under Norton Safe Web icon. Once we get that reply, we will go ahead and escalate this case to concern team.”

I don't understand why the Norton support representative did not escalate the issue. Why was I was asked to do more to get the issue escalated? I have already indicated a source that contains more than enough documentation and screenshots. Despite my frustration, I have attempted to perform the actions suggested by the Norton support representative. I really want an answer to my question.

As alluded to by the support representative, I did receive an email regarding my case. In response, I sent an email to the ‘sent from’ email address indicating my issue was not resolved, and that I need help from the Norton Safe Web team. I reiterated that this Norton Community Forum post should be referenced. I also generated, and attached, a screen capture video that clearly describes the issue.

I also tried to follow the Norton support representative’s direction about submitting feedback to the Norton Safe Web team by way of the Norton Safe Web website safeweb.norton.com. I did not experience what I inferred would occur based on the Norton support representative’s direction. I ended up clicking on the ‘Leave Feedback’ link at the bottom of the safeweb.norton.com home page. I entered information about my issue in the resulting form and submitted it.

As I wait for a response, please let me know if you have any recommendations on other avenues to contact the Norton Safe Web team.

P.S. I have uploaded my screen capture video to this post. See File Attachment: Video - screen recording showing Norton Safe Web issue described in this post.

Thank you.

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Hi @slax

Just to see on my side.   I Log'd in at 'my.anglr.tech'.

I received Welcome email with links...for example: "ANGLR and how it works" (see link status bar).
link status bar URL

http://e.customeriomail.com/e/c/eyJlbWFpbF9pZCI6IlJLSEZCQUFBQVc2bUlPU1YwS3pHdkQ0VUpwMEV1dz09IiwiaHJlZiI6Imh0dHBzOi8vYW5nbHIuY29tL2Zpc2hpbmctYXBwL2hvdy1pdC13b3Jrcy8_dXRtX2NhbXBhaWduPVVTRVIrJTdDKzErJTdDK1NpbmdsZStQcmVtaXVtKzE0K0RheStUcmlhbCslMjhBQ1RJVkUlMjlcdTAwMjZ1dG1fY29udGVudD1EYXkrMSstK1dlbGNvbWUrLStQcmVtaXVtK1RyaWFsK0hhcytCZWd1blx1MDAyNnV0bV9tZWRpdW09ZW1haWxfYWN0aW9uXHUwMDI2dXRtX3NvdXJjZT1jdXN0b21lci5pbyIsImxpbmtfaWQiOjIxNTMsInBvc2l0aW9uIjowfQ/4849ad8f209d64016e13895dc7130db32bb35c4b33e434c3836a41cb5f1e1a06

lands on
 

https://anglr.com/fishing-app/how-it-works/?utm_campaign=USER+%7C+1+%7C+Single+Premium+14+Day+Trial+%28ACTIVE%29&utm_content=Day+1+-+Welcome+-+Premium+Trial+Has+Begun&utm_medium=email_action&utm_source=customer.io

https://safeweb.norton.com/report/show?url=https://anglr.com/fishing-app/how-it-works/ = UNTESTED

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

another email from Derek at ANGLR <derek(@)anglr.com>
all ANGLR email links land on 'anglr.com' page 

https://anglr.com/expert/mike-cheatham/?utm_campaign=Fishing+[...]

with 'e.customeriomail.com' reported in Safe Web dialog box

http://e.customeriomail.com/e/c/eyJlbWFpbF9[...]

anglr.com = UNTESTED
https://safeweb.norton.com/report/show?url=anglr.com

Kudos1 Stats

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Hi @slax

example: Norton Link Guard clicking on email suspicious link >
lands on >

Email Suspicious Link URL =

https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fwww.tingleyrubber.com%2fproducts%2fworkbrutes-g2-10-inch-work-boot%3f_pos%3d1%26_sid%3db69f36391%26_ss%3dr&c=E,1,sUbyH_xKQufa8HgU36vw0nau67ODsACMyr5pnlBkVuhX_YHEGZ1pzM4Sqfqo3xAUr1K1eY6hBKeVrNCD3SrE_Djb-umANstrFhlAH8A_&typo=1

https://safeweb.norton.com/report/show?url=https://linkprotect.cudasvc.com/url = WARNING

Browser address bar URL =

https://www.tingleyrubber.com/products/workbrutes-g2-10-inch-work-boot?_pos=1


https://safeweb.norton.com/report/show?url=tingleyrubber.com = SAFE


and FWIW >

@floplot

1) Please ask your Safe Web contact:  Why Norton Safe Web reports on the calling URL and not on the landing URL. 
2) Please ask your Safe Web contact: Does Norton Safe Web reporting on the calling URL vs reporting on the landing URL ... represent expected correct working as designed Safe Web behavior.

3) Please ask your Norton Safe Web contact: to view and comment on @slax video here >
https://community.norton.com/en/comment/8263101#comment-8263101

4) Please ask your Norton Safe Web contact: on a redirect > does Safe Web report on the calling URL or on the landing URL. 

Thanks

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Hello bjm

I will ask the Safe Web Team to read over your posts and to answer the questions that you asked.

Have a Good Night and

Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit 1903 Norton Core Security Plus 22.19.9.63 Core Firmware 288 Android App 2.22 Chrome latest version.
Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Hi @bjm_ and @floplot,

I really appreciate all the time and effort you have put into helping me get my issue resolved. I hope we get a response from the Safe Web Team soon.

Thanks.

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Hi @slax,

Thanks so much for the details provided for above reported issue. We have reported to concern team and will update once we get more details on the fix. 

Sunil_GA | Norton Forums Administrator | Symantec Corporation
Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

What Is a Referrer?
https://www.lifewire.com/what-is-a-referrer-3468987

Safe Web reports on the "referrer" (referring URL) .... regardless, of where "referrer" lands?


Google Safe Browsing page block >

http://www.rugbystore.shop/wa/homes/complete.php

report a detection problem >
Continue to the site + Continue without Isolation Mode

https://safebrowsing.google.com/safebrowsing/report_error/?tpl=mozilla

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

adding:
Maybe, observation/s are browser specific (OP on Firefox) and or which URL loads first.

for example: URL links from openphish.com on Chrome.

http://gosnellspodiatry.com.au/system_php/eir_webmail.php

1) Google Safe Browsing page block loads before URL from openphish.com reports 'about:blank' in Safe Web dialog box.
https://safeweb.norton.com/report/show?url=http://gosnellspodiatry.com.au/system_php/eir_webmail.php


https://reesemessage.com/Me

2) Google Safe Browsing page block loads after URL from openphish.com reports 'reesemessage.com/Me' in Safe Web dialog box.

https://safeweb.norton.com/report/show?url=https://reesemessage.com/Me


and on Chrome > report a detection problem reports 'google.com/safebrowsing/report_error' in Safe Web dialog box.

https://safeweb.norton.com/report/show?url=https://www.google.com/safebrowsing/report_error/


I'll imagine Safe Web reporting is influenced by call n' land variables.

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

adding:

https://safeweb.norton.com/report/show?url=leaders.pl

Open Link in New Tab = 'aftermarket.pl' in Firefox address bar (after Safe Web page block + Continue to the site + Continue Without Isolation Mode) with 'leaders.pl' in Safe Web dialog box.

Open Link in New Tab = 'aftermarket.pl' in Firefox address bar (after Safe Web page block + Continue to the site + Continue Without Isolation Mode) with 'leaders.pl' in Safe Web dialog box.


https://safeweb.norton.com/report/show?url=aftermarket.pl

Kudos0

Re: The Safe Web icon in Firefox's toolbar indicates that a particular URL is safe or is untested, depending on whether the site was arrived at by clicking an email link, or by manually inserting the URL, respectively.

Hi @slax

Earlier if this thread.  I wrote = "I pay attention to URL in the Safe Web dialog". 

Now, I'm thinking.
I'll ignore Safe Web button color n' button dialog box.
I'll simply pay attention to Safe Web page block. 

Chrome, Firefox and Edge built-in Phishing and Malware Protection simply prompts page block for websites and simply prompts block for malware downloads.