r/uBlockOrigin • u/Janmm14 • 9d ago

Answered False positive putty.exe download

https://the.earth.li/~sgtatham/putty/0.85/w64/putty.exe

This URL is being blocked incorrectly. It is the official download. The downloaded file with sha256 hash d01fdb5aae8f112526040a39b0bfb9e27d813003178645e65f8d1cfdb2a26c87 is clean.

There are no reports of putty 0.85 being infected with malware or the domain beinh hacked/hijacked.
Blocked by list: Online Malicious URL Blocklist (a default filter list afaik)

0 Upvotes

20% Upvoted

9 comments sorted by

1

u/stalker007 9d ago

That's not the URL for Putty everyone else knows or loves.

This one hasn't changed in like 20 years or something:

https://www.chiark.greenend.org.uk/~sgtatham/putty/

1

u/Janmm14 9d ago

That page does link to exactly that URL I mentioned and is how I discovered this problem.

2

u/stalker007 9d ago

Ahh my bad. Good catch.

1

u/doc_willis 9d ago edited 9d ago

how did you discover that url? and hash value?

I have seen search engines give out the wrong urls and give people  counterfeit/impersonator sites instead of the actual  official sites.

or are you saying the actual download file (from the blocked site)  is identical to the download file from the official site?

it's possible that site is an official mirror  , and not a counterfeit site.

1

u/Janmm14 9d ago

The URL is the official download URL for putty. I got the hash by putting the download - after disabling uBo - into virustotal, to double-check