Re: Invoke-Webrequest caused security alert (and blocking!)

Look up how to set up a local mirror.

Lyle Giese

On 6/11/25 10:58, Shulist, Victor (SSC/SPC) via clamav-users wrote:
>
> Unclassified | Non classifié
>
>
> Unclassified | Non classifié
>
> Hello ClamAV support !
>
> I was trying to download (using Edge browser) the *.cvd files from 
> your site.  That failed, so I tried using power shell’s ‘invoke 
> webrequest’  method.  That seemed to have trigged a security alert on 
> your side.
>
> Below is the command I issued.
>
> After I tried using just Chrome browser, I saw a stackoverflow page 
> that suggested you have to give a unique value for UserAgent.  Perhaps 
> that is what triggered the alert?
>
> We’re in a closed (air gapped) network here, which is why I had to try 
> this method.
>
> thanks
>
> PS C:\Users\ShulistV> Invoke-WebRequest -Uri 
> https://database.clamav.net/main.cvd -UserAgent 'CVDUPDATE/0 
> (43fde49b-905f-43c6-a51be1324cd23280)'
>
> Invoke-WebRequest :
>
> Please enable cookies.
>
> Sorry, you have been blocked
>
> You are unable to access clamav.net
>
> Why have I been blocked?
>
> This website is using a security service to protect itself from online 
> attacks. The action you just performed triggered the security 
> solution. There are several actions that could trigger this block 
> including submitting a certain word or phrase, a SQL command or 
> malformed data. What can I do to resolve this?  You can email the site 
> owner to let them know you were blocked. Please include what you were 
> doing when this page came up and the Cloudflare Ray ID found
>
> at the bottom of this page.
>
> Cloudflare Ray ID: 94e236b5fb9aa2ab • Your IP: Click to reveal 
> 198.103.167.20 •  Performance & security by Cloudflare
>
> (function(){function d(){var 
> b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in 
> b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var 
> a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})(); 
> window._cf_translation = {};
>
> At line:1 char:1
>
> + Invoke-WebRequest -Uri https://database.clamav.net/main.cvd 
> -UserAgen ...
>
> + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> + CategoryInfo          : InvalidOperation: 
> (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], 
> WebException
>
> + FullyQualifiedErrorId : 
> WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
>
> PS C:\Users\ShulistV>
>
> Victor Shulist*(Consultant)*
>
> Specialized Security Services
>
> Connectivity and Security Services Branch (CSSB)
>
> Shared Services Canada | Government of Canada
>
> [email protected] <mailto:[email protected]>| 
> Tel: 613-227-1600
>
> Titre Consultant, Services de sécurité spécialisés
>
> Direction générale des services de connectivité et de sécurité (DGSCS)
>
> Services partagés Canada | Gouvernement du Canada
>
> [email protected] <mailto:[email protected]>  | 
> Tél: 613-227-1600
>
> Victor Shulist*(Consultant)*
>
> Specialized Security Services
>
> Connectivity and Security Services Branch (CSSB)
>
> Shared Services Canada | Government of Canada
>
> [email protected] <mailto:[email protected]>| 
> Tel: 613-227-1600
>
> Titre Consultant, Services de sécurité spécialisés
>
> Direction générale des services de connectivité et de sécurité (DGSCS)
>
> Services partagés Canada | Gouvernement du Canada
>
> [email protected] <mailto:[email protected]>  | 
> Tél: 613-227-1600
>
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat