Ai Protection warning page completely blank

[JIPG]

I have installed Merlin FW 386.1_2 in a RT-AX88U router and everything is running well.
I am surprised that running temperatures are low (CPU around 63 degrees Celsius, when my previous RT AC87U was always near 80 degrees), and apart from a log with a lot of entries, I am a happy user.

I have Ai Protection enabled, but I have had no entries in the malware detection logs during the month I have the AX88U (before it was not the case with the RT-AC87U, where the log was plenty of entries). I have tried with a url provided by TrendMicro to test it (http://wrs21.winshipway.com) and it is recorded correctly, so the protection seems to be working. Nevertheless, the warning page from TendMicro, that should provide the information about the threat, appears completely blank:

But it should be something like this:

Maybe someone can provide some advice about this problem. Is that information provided by Trend Micro in real time when accessing the website, or are the messages built-in in the FW?.

It is not a big deal for me, but I would like my family be aware if they have ended in a dangerous page, so if the text has disappeared by any error during the installation, I would like to recover it.

The Trend Micro Signature is up to date (2.218, updated just today) so it is not a problem with the Trend Micro database.

Any help will be very welcomed.

 

[RMerlin]

The warning page will only be properly shown if blocking an http site. https warning pages cannot be shown due to the certificate and the port being different.

 

[JIPG]

The warning page will only be properly shown if blocking an http site. https warning pages cannot be shown due to the certificate and the port being different.

Thank you for your answer RMerlin. I have already learned with the firewall rules I put for my sons that https urls are not filtered .

Nevertheless, the url that I tried, provided by Trend Micro is http (http://wrs21.winshipway.com) , but the warning page is blank.

 

[RMerlin]

Thank you for your answer RMerlin. I have already learned with the firewall rules I put for my sons that https urls are not filtered .

Nevertheless, the url that I tried, provided by Trend Micro is http (http://wrs21.winshipway.com) , but the warning page is blank.

Works for me on my own RT-AX88U.

 

[JIPG]

Works for me on my own RT-AX88U.

Thank you for the hint. I changed the GUI language to English and now I have the correct warning page. So probably, the Spanish translation is lost.

I do not know if something was messed during the FW installation but there is no other things working wrong (I went from stock 386.41700 to Merlin 386.1 beta 5 (dirty update), then clean install to Merlin 386.1 (erasing jffs on next reboot twice because it was not mounted correctly the first time) and then dirty update to Merlin 386.1_2).

If the translation is not present in the GPL 386.41700 (I did not tried Ai Protection with this release as it was used only during few hours), then it is time for ASUS to correct it.

 

[JIPG]

Please, could someone help me confirming that in FW 386.2 beta the warning page from TendMicro (as shown in the first post) works when the GUI is in Spanish or German? (other GUI languages seems to work correctly in 386.1_2).

 

[MvW]

Just tried on my RT-AC86U, the url you provided results in:

That's not the AiProtection page I'm used to see. Language is set to English. Cleared cache to make sure, but still show the same. Running 386.2 beta 2.

 

[JIPG]

Just tried on my RT-AC86U, the url you provided results in:

View attachment 32290

That's not the AiProtection page I'm used to see. Language is set to English. Cleared cache to make sure, but still show the same. Running 386.2 beta 2.

MvW, Thank you for the trial. But I would like to know if this works also with the GUI in Spanish for FW 386.2 beta. In FW 386.1_2, there are a few languages where the warning page is blank (I checked Spanish, German, Danish), while in others it was OK (I tried English, French, Italian, Chinese, Turkish).

For instance, one of my sons visited by error "yotube.com" and he had a blank warning page (without any text), so he was not aware that the page had some dangerous content. I prefer they can read a warning and learn about malicious sites.

 

[MvW]

while in others it was OK (I tried English, French, Italian, Chinese, Turkish).

The page that is showed above is not OK. That's not the default AIProtection Malicious Site Warning page.

I just changed the GUI language to Spanish, the result is exactly the same as the screenshot I posted above. Cleared my cache. Tried three browsers (FF, Chrome, Edge Chromium), all the same result.

Edit: I tried yotube.com, which gets blocked by NextDNS (and therefore shows the NextDNS blocking Page)

I don't know where the other 'blocking' page comes from. The attempts are not counted in AIProtection Malicious Site Blocking stats, so I'm not sure this is firmware related or whether they're being blocked for some other reason.

 

[JIPG]

The page is showed above is not OK. That's not the default AIProtection Malicious Site Warning page.

I just changed the GUI language to Spanish, the result is exactly the same as the screenshot I posted above. Cleared my cache. Tried three browsers (FF, Chrome, Edge Chromium), all the same result.

Edit: I tried yotube.com, which gets blocked by NextDNS (and therefore shows the NextDNS blocking Page)

I don't know where the other 'blocking' page come from. The attempts are not counted in AIProtection Malicious Site Blocking stats, so I'm not sure this is firmware related or whether they're being blocked for some other reason.

That is curious. With Spanish GUI (FW 386.1_2) , I have this image in Firefox , Internet Explorer 11 and Edge chromium for any blocked page:

With the GUI in English, I have this page:

or with yotube.com url:

All attempts are recorded in Ai Protection.
Maybe you have another instance that is blocking the page before Trend Micro stuff ...

 

[MvW]

That is curious.

It is indeed. And I'm only using NextDNS, SkyNet (which would cause a timeout) and AIProtection. I also have Norton Security 360 installed, but that would show a popup on the taskbar and refuse to load the page so, I don't have a clue where these warnings come from. I looked at the source of the page, but they show nothing else than is being displayed.

Maybe someone else with an RT-AC86U running 386.2 beta 2 can visit wrs21.winshipway.com/ and see what the result is?

I tried visiting a site which was caught earlier this week by AIProtection but unfortunately (for me, at least) it has been whitelisted in the meantime, so I can't verify.