Deceptive Site Ahead

[GodBleak]

Describe The Bug
A domain hosting Jellyfin is flagged by Google as a "Deceptive Site".

Steps To Reproduce
Unknown

System (please complete the following information):

• Browser: Firefox, Chrome
• Jellyfin Version: 10.8.5 (linuxserver/jellyfin:10.8.5-1-ls180)

Additional Context
Google claims that https://example.tld/web/index.html

attempts to trick users into doing something dangerous, such as installing unwanted software or revealing personal information.

I've appealed to Google twice now, but the domain continues to be flagged.
This issue has been further documented on a few reddit posts:

• Deceptive Site Ahead
• "Deceptive site ahead" warning on my self hosted jellyfin web app

[thornbill]

Does entering your url here provide any information about what they believe is an issue? https://transparencyreport.google.com/safe-browsing/search

We really have nothing to go off of for this currently.

[GodBleak]

Unfortunately, this is all it says

Current status warning
This site is unsafe

The site https://example.tld/web/index.html contains harmful content, including pages that:

• Try to trick visitors into sharing personal info or downloading software

I'm unsure how I'd get more info. I'm open to sharing the domain with a maintainer privately, if it helps.

[thornbill]

Are you using any third party css?

[lednerg]

The same thing just happened to me tonight. My server's been using the same IP (from Comcast) for at least a couple years now. I'm currently on version 10.8.1 and am not using any third party CSS. I have the following plugins installed: (PNG of plugins page).

EDIT: This is blocking the Android app from working as well. So while web browsers can bypass the warning, and I can still access it on the local network, my server is completely inaccessible on remote Android devices.

[GodBleak]

Sorry @thornbill, was only just notified of updates on the thread, no I'm not using any third-party CSS

[mcshaman]

Same issue here!

[viletuna]

I'm also having the same issue. Twice now with two different servers. Both were using duck DNS and caddyv2. Requesting Google to remove the flag worked temporarily before being flagged again

[GodBleak]

I've done a bit of digging. It seems the YunoHost community is also experiencing this. With further digging I found a few things that leads me to suspect our domains are being flagged for "Insufficiently labeled third-party services".

1. While not directly related to Safe Browsing (and thus this error), I found this notice from NameCheap:

   Please be informed that the xxxxxx domain name was reported as involved in abusive activity by a trusted organization. During the investigation, it was noticed that your website content is a copy of the Bitwarden official website. On that ground, we were forced to suspend the domain name due to phishing activities, which include unauthorized use of the legitimate organization denomination and attempts to acquire sensitive information such as usernames, passwords, etc

   And they follow that up with:

   you will need to provide us with paperwork proving your cooperation with the Bitwarden website and their consent to use their official denomination in your domain name.

   This indicates that NameCheap is actively identifying and responding to IP (intellectual property) violations used for phishing. Since Bitwarden is another self-hostable, open-source project, it's highly unlikely that this action was prompted by the Bitwarden team themselves. This suggests that NameCheap is independently detecting supposed IP violations and issuing notices accordingly. This behavior appears similar to what we're experiencing with Google, hinting at a broader industry trend.

2. This comment regarding the Deceptive Site warning also seems to indicate that this is more of a branding/IP problem, rather than just an issue with the source code.

3. And this comment on StackOverflow where someone supposedly received the warning on a site imitating Netflix, also believes that the issue is a result of the imitation.

4. Eventually, I found this article by Google on social engineering where they show deceptive content examples

   This one caught my eye.
   

   Its layout is similar to the JellyFin login page, right? A page at the root path of a domain (true for both the OP of the YunoHost thread and myself) using a trusted third-party's logo in an authoritative position, with the page's sole purpose clearly being to collect credentials. YunoHost shares this layout as well. Additionally, both apps use the product name in the page title, along with the product's logo as the favicon.

I surmise that the combination of the following elements

• the page title being "JellyFin"
• the page favicon using the JellyFin logo
• the authoritative location of the JellyFin logo
• the page's sole purpose being to collect credentials, and
• the service being hosted at the root path of the FQDN

leads to Google thinking we're trying to impersonate JellyFin.

[mcshaman]

Interesting hypothesis @GodBleak. Do you know if it is possible to override all these on the landing page?

[thornbill]

I suspect the meta tags here may be to blame, but someone would have to test that to verify since Google is providing no usable information.

https://github.com/jellyfin/jellyfin-web/blob/master/src/index.html#L15-L19

[NeonWizard]

I disputed the "deceptive site warning" through the Google search console about a week ago, and the error has yet to come back.

[VTStation]

I disputed the "deceptive site warning" through the Google search console about a week ago, and the error has yet to come back.

I'v had this issue since mid of sept , lodge a review to google via search console ,they would lift the block and then aweek later it will be blocked again. I'v been blocked 4 times , rebuilt the server the first time after finding no issues , they still blocked it and i have continued to send them the same review response " please stop blocking this private site " they have lifted the block every time.. Iv stopped sending reviews to google 'i gave up .. using jellyfin in kodi app is my work around .

[lednerg]

I suspect the meta tags here may be to blame, but someone would have to test that to verify since Google is providing no usable information.

https://github.com/jellyfin/jellyfin-web/blob/master/src/index.html#L15-L19

Twelve days ago I changed all five of those meta tags in my jellyfin-web\index.html file so that they're all unique to my server and I have yet to be blocked by Google again. I've logged in and out remotely several times since then using Google devices/programs. I'm not saying I'm sure this is definitely a fix, I'm just sharing my experience. BTW, editing that file was a pain since it's all on one line.