Security: pokeapi.co flagged as Malicious on VirusTotal; recommend removal from defaults.

[huanguan1978]

Description:
I noticed that the domain pokeapi.co, which is included in the default URL set, is currently flagged as Malicious by several security vendors on VirusTotal.

While this might be a false positive, having a flagged domain in the default configuration can trigger security alerts for users and impact the project's reputation. For safety and better user experience, I recommend removing it from the default URL collection.

Supporting Evidence:

• VirusTotal Detection: https://www.virustotal.com/gui/domain/pokeapi.co/detection
• Please refer to the attached screenshot for the specific vendors and detections.

[huanguan1978]

[OutdatedGuy]

Thanks for pointing this out but...

currently flagged as Malicious by several security vendors on VirusTotal.

I only see one vendor marking this as malicious. Even google.com is marked as malicious on this tool.

[huanguan1978]

I appreciate your perspective. However, I believe comparing pokeapi.co to google.com is slightly misleading because of the difference in brand trust.

For a third-party library or app, a "Malicious" flag is a critical friction point. It creates a trust crisis at every stage of the user journey:

• During Installation: Users may abort the installation immediately upon seeing a security alert.
• On First Launch: Security software might block the request, leading users to believe the app is broken or harmful.
• During Routine Use: Even loyal users are likely to uninstall the app once their system flags a connection to a "malicious" domain.

While Google has the reputation to bypass such doubts, a niche API does not. For developers, this doesn't just mean a false positive; it means losing users at a high rate and facing potential rejection from App Stores during automated security scans.

Until the false positive is resolved with the security vendors, removing it from the default configuration is a safer and more developer-friendly approach. It ensures that the project remains a reliable foundation for production-ready apps.

[OutdatedGuy]

Thanks for the insight. However, I was not comparing pokeapi.co to google.com. I was questioning the validity and reliability of VirusTotal itself.

Anyways, I'll try to look for a more reliable API when I get some time.

[huanguan1978]

Thanks for the feedback. I’ve categorized the most reliable alternatives based on compliance and global accessibility:

1. Recommended Default (HTTPS & Globally Accessible)

• Apple: https://captive.apple.com/hotspot-detect.html
• Why: It supports HTTPS, which is now a mandatory requirement for App Store (ATS) compliance. Unlike Google or Cloudflare services, Apple’s endpoints are rarely affected by regional firewalls (e.g., in China), making it the most robust global choice.

2. The Best HTTP Alternative

• Microsoft: http://www.msftconnecttest.com/connecttest.txt
• Why: This is the official Windows connectivity test. It uses HTTP by design to detect "Captive Portals" (Wi-Fi login pages). It’s highly reliable but may require extra security configuration for mobile apps due to the lack of HTTPS.

3. Regional Extensions
For apps targeting specific restricted markets, developers can easily extend the logic with local endpoints such as Baidu (https://www.baidu.com) or Alibaba (http://www.taobao.com/generate_204).

Summary:
Switching to Apple’s HTTPS endpoint is the most "production-ready" move. It resolves the VirusTotal alerts, ensures App Store compliance, and provides stable global connectivity out of the box.

Best regards