[FALSE-POSITIVE] key2stats.com - Legitimate K-12 education platform

[33sigma]

What are the subjects of the false-positive (domains, URLs, or IPs)?

key2stats.com

Flagged URL:

https://key2stats.com/frontend/web/assets/c9976024/themes/ui-darkness/images/tree/wtff/?email=eticka.linija@t.ht.hr

Why do you believe this is a false-positive?

key2stats.com is a legitimate educational technology (EdTech) platform for K-12 statistics education, used by teachers and students at Boston Public Schools and other districts.

The flagged URL path /frontend/web/assets/c9976024/themes/ui-darkness/images/tree/wtff/ is not and has never been a phishing page:

• /frontend/web/assets/c9976024/ — Yii2 PHP framework auto-generated asset hash directory from a past deployment (no longer exists)
• themes/ui-darkness/ — Standard jQuery UI theme (open-source UI library)
• images/tree/ — Treeview widget icon directory from jQuery UI
• wtff/ — This path never existed as intentional content. It was appended by a phishing probe or vulnerability scanner.

The full URL returns HTTP 404 (Not Found). No content is served at this path. The ?email= parameter was never processed by our application here.

How did you discover this false-positive(s)?

The domain was blocked by iboss (school district web content filter) at Boston Public Schools, preventing students and teachers from accessing their learning platform during class. Investigation traced the block to this Phishing.Database listing.

Where did you find this false-positive if not listed above?

This false positive has cascaded to multiple downstream security vendors:

• Avira — flags key2stats.com
• Fortinet / FortiGuard — flags key2stats.com
• Norton SafeWeb — flags key2stats.com as "WARNING - known dangerous webpage"
• iboss (school content filter) — blocks key2stats.com based on upstream feeds

Have you requested a review from other sources?

Yes — reviews submitted to Avira, Fortinet/FortiGuard, Norton SafeWeb, and BrightCloud/Webroot.

Do you have a screenshot?

N/A — the flagged URL returns a 404 page. There is no phishing content to screenshot.

Additional Information or Context

• Domain owner: Key2Stats LLC — educational technology company
• Platform purpose: Interactive statistics education for K-12 students and teachers
• Infrastructure: Hosted behind Cloudflare with comprehensive security headers (HSTS, CSP, X-Frame-Options, etc.)
• Framework: Yii2 PHP — the flagged path is a framework artifact, not user-created content
• Google Safe Browsing: Clean — no unsafe content found
• Impact: Students at Boston Public Schools are currently unable to access their learning platform

[phishing-database-bot]

Closing.

Subject(s) not found in the Phishing.Database project: t.ht.hr, key2stats.com.

-- We appreciate your help in refining this. Please let us know if anything seems incorrect.

[phishing-database-bot]

Verification Required

@33sigma, thank you for submitting a false positive report! To help us verify your ownership of the affected domain(s), please complete the following steps:

1. Set a DNS TXT record for the domain(s) listed in this issue with the following details:

   • Record Name: _phishingdb
   • Record Value: antiphish-87d64527c9b43f56f9d702e04a924b6cb2072dc1

   Your Verification ID: antiphish-87d64527c9b43f56f9d702e04a924b6cb2072dc1

2. Wait for DNS propagation (this may take a few minutes to a few hours).

3. Reply to this issue once the TXT record has been set.

Important Notes

• Verification does not guarantee whitelisting. The Phishing.Database team will review your report after verifying ownership, but the decision to whitelist depends on further investigation and analysis.
• If the record cannot be set or you need alternative methods of verification, please contact us at support@phish.co.za - preferably from the domain's official email address.

How to Check the TXT Record ?

You can verify that the TXT record is properly set using:

• Online tools like MXToolBox TXT Lookup.
• The command line:

  dig TXT _phishingdb.example.com
  

Thank you for your cooperation! We will address your issue as soon as possible after verification.

The Phishing.Database Project Team.