What's new

Ai Protection warning page completely blank

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

JIPG

Regular Contributor
I have installed Merlin FW 386.1_2 in a RT-AX88U router and everything is running well.
I am surprised that running temperatures are low (CPU around 63 degrees Celsius, when my previous RT AC87U was always near 80 degrees), and apart from a log with a lot of entries, I am a happy user.

I have Ai Protection enabled, but I have had no entries in the malware detection logs during the month I have the AX88U (before it was not the case with the RT-AC87U, where the log was plenty of entries). I have tried with a url provided by TrendMicro to test it (http://wrs21.winshipway.com) and it is recorded correctly, so the protection seems to be working. Nevertheless, the warning page from TendMicro, that should provide the information about the threat, appears completely blank:

screen capture2.jpg

But it should be something like this:

screen capture3.jpg


Maybe someone can provide some advice about this problem. Is that information provided by Trend Micro in real time when accessing the website, or are the messages built-in in the FW?.

It is not a big deal for me, but I would like my family be aware if they have ended in a dangerous page, so if the text has disappeared by any error during the installation, I would like to recover it.

The Trend Micro Signature is up to date (2.218, updated just today) so it is not a problem with the Trend Micro database.

Any help will be very welcomed.
 
The warning page will only be properly shown if blocking an http site. https warning pages cannot be shown due to the certificate and the port being different.
 
The warning page will only be properly shown if blocking an http site. https warning pages cannot be shown due to the certificate and the port being different.
Thank you for your answer RMerlin. I have already learned with the firewall rules I put for my sons that https urls are not filtered :mad:.

Nevertheless, the url that I tried, provided by Trend Micro is http (http://wrs21.winshipway.com) , but the warning page is blank.
 
Thank you for your answer RMerlin. I have already learned with the firewall rules I put for my sons that https urls are not filtered :mad:.

Nevertheless, the url that I tried, provided by Trend Micro is http (http://wrs21.winshipway.com) , but the warning page is blank.
Works for me on my own RT-AX88U.
 
Works for me on my own RT-AX88U.
Thank you for the hint. I changed the GUI language to English and now I have the correct warning page. So probably, the Spanish translation is lost.

I do not know if something was messed during the FW installation but there is no other things working wrong (I went from stock 386.41700 to Merlin 386.1 beta 5 (dirty update), then clean install to Merlin 386.1 (erasing jffs on next reboot twice because it was not mounted correctly the first time) and then dirty update to Merlin 386.1_2).

If the translation is not present in the GPL 386.41700 (I did not tried Ai Protection with this release as it was used only during few hours), then it is time for ASUS to correct it.
 
Please, could someone help me confirming that in FW 386.2 beta the warning page from TendMicro (as shown in the first post) works when the GUI is in Spanish or German? (other GUI languages seems to work correctly in 386.1_2).
 
Just tried on my RT-AC86U, the url you provided results in:

Screenshot_2021-03-21 Screenshot.png


That's not the AiProtection page I'm used to see. Language is set to English. Cleared cache to make sure, but still show the same. Running 386.2 beta 2.
 
Just tried on my RT-AC86U, the url you provided results in:

View attachment 32290

That's not the AiProtection page I'm used to see. Language is set to English. Cleared cache to make sure, but still show the same. Running 386.2 beta 2.
MvW, Thank you for the trial. But I would like to know if this works also with the GUI in Spanish for FW 386.2 beta. In FW 386.1_2, there are a few languages where the warning page is blank (I checked Spanish, German, Danish), while in others it was OK (I tried English, French, Italian, Chinese, Turkish).

For instance, one of my sons visited by error "yotube.com" and he had a blank warning page (without any text), so he was not aware that the page had some dangerous content. I prefer they can read a warning and learn about malicious sites.
 
Last edited:
while in others it was OK (I tried English, French, Italian, Chinese, Turkish).

The page that is showed above is not OK. That's not the default AIProtection Malicious Site Warning page.

I just changed the GUI language to Spanish, the result is exactly the same as the screenshot I posted above. Cleared my cache. Tried three browsers (FF, Chrome, Edge Chromium), all the same result.

Edit: I tried yotube.com, which gets blocked by NextDNS (and therefore shows the NextDNS blocking Page)

I don't know where the other 'blocking' page comes from. The attempts are not counted in AIProtection Malicious Site Blocking stats, so I'm not sure this is firmware related or whether they're being blocked for some other reason.
 
Last edited by a moderator:
The page is showed above is not OK. That's not the default AIProtection Malicious Site Warning page.

I just changed the GUI language to Spanish, the result is exactly the same as the screenshot I posted above. Cleared my cache. Tried three browsers (FF, Chrome, Edge Chromium), all the same result.

Edit: I tried yotube.com, which gets blocked by NextDNS (and therefore shows the NextDNS blocking Page)

I don't know where the other 'blocking' page come from. The attempts are not counted in AIProtection Malicious Site Blocking stats, so I'm not sure this is firmware related or whether they're being blocked for some other reason.
That is curious. With Spanish GUI (FW 386.1_2) , I have this image in Firefox , Internet Explorer 11 and Edge chromium for any blocked page:
1616359706337.png

With the GUI in English, I have this page:
1616359933470.png

or with yotube.com url:
1616360073425.png

All attempts are recorded in Ai Protection.
Maybe you have another instance that is blocking the page before Trend Micro stuff ...
 
Last edited:
That is curious.
It is indeed. And I'm only using NextDNS, SkyNet (which would cause a timeout) and AIProtection. I also have Norton Security 360 installed, but that would show a popup on the taskbar and refuse to load the page so, I don't have a clue where these warnings come from. I looked at the source of the page, but they show nothing else than is being displayed.

Maybe someone else with an RT-AC86U running 386.2 beta 2 can visit wrs21.winshipway.com/ and see what the result is?

I tried visiting a site which was caught earlier this week by AIProtection but unfortunately (for me, at least) it has been whitelisted in the meantime, so I can't verify.
 

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top