Having decided to learn about sandboxes and download Cuckoo, Avira tells me that this is a malware site that can infect my computer:

https://cuckoosandbox.org/ -> click "Download Cockoo!" -> Avira warning, blocking the download website Avira warning screenshot

I am little bit astonished since Cuckoo seemed to have a good reputation and is even mentioned positively in AVIRA blogs (https://blog.avira.com/cuckoo-sandbox-vs-reality-2/ and https://blog.avira.com/vmcloak-create-virtual-machine-easy-way/, so I think this might(?) be a false alarm.

Questions: Are there any known security issues with Cuckoo and the Cuckoo website itself? I Would be surprised, but are there download sites safer than the genuine (please correct me if this is a fake site) https://cuckoosandbox.org/?

System information: Win-10, Firefox 52.0.2, Avira free, version (in AVIRA help, there is usualle just the answer that trusted websites can be unblocked, but my question is how to tell if trustworthy in this special case)

closed as off-topic by Steve, Anders, Xander, Trey Blalock, Stephane Apr 11 '17 at 9:29

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steve, Anders, Xander, Trey Blalock, Stephane
If this question can be reworded to fit the rules in the help center, please edit the question.


There are generally two kinds of website security alerts:

  1. Blacklist-based, where a threat researcher or server-based scanner determines a page is bad based on thousands of potential criteria, and distributes its findings to clients. Because both humans and machines are making judgement calls, there's plenty of opportunity for legitimate sites to be blacklisted. This is especially prone to happen on security-themed websites since they discuss and include scary-looking things
  2. Client-side script scanning, where the antivirus locally scans and emulates JavaScript in real-time to determine if a website is bad. These results are usually more exact and reliable, but still open to false-positives.

It appears this alert is the first, a blacklist-based detection. It's not surprising a computer security website where you download something to do malware analysis is miscategorized as malware.

Additionally, I've examined the website and run it through URLquery.net and it seems clean to me. I wouldn't worry about this.


  • Thanks! But wouldn't one expect that blacklisting does not affect popular and legitimate websites if a) a website should be known to human experts in an IT security company (for expert-based scanning), or b) are curated for very popular websites (so far I understand that Cuckoo is) in case of machine-based scanning? Don't get me wrong, I am not blaming anyone for Aviras policy (and not Avuira for providing free service), I am just curious and want to learn. – Martin Apr 8 '17 at 10:12
  • @Martin- Most tools that have dual purpose (useful for researchers and for attackers) will be flagged by av tools. This is by design. You wouldn't want a research tool whitelisted if it could also be used by an attacker... – Rory Alsop Apr 12 '17 at 6:31
  • Thanks - may I ask you to elaborate further on how such a tool like Cuckoo can be of "dual" use? Maybe this is the answer I am looking for. Do you think of a) attackers use it indirectly, on their computer, e.g. to develop their malware (i.e. it is not harmful to use it myself = "falsely" flagged by Avira), or b) attackers make use of Cuckoo after I install Cuckoo on my computer (b/o untrusted code in Cuckoo, because it disturbs other safety features on my computer, ...)? In case the last scenario is true, I would like to learn about it (and how to protect myself). – Martin Jun 8 '17 at 21:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.