Malware on the Site?

stormchaser · Post by **stormchaser** » Fri Nov 19, 2021 5:55 pm

It “might” be a false positive but every time I go to the Nebraska and Iowa forum on this site, my router blocks malware. It’s only on that specific section so I doubt it’s a false positive. Just letting the admins know anyway

stormchaser · Post by **stormchaser** » Fri Nov 19, 2021 5:57 pm

This is the specific file/link in question:

Post by **Omaha Cowboy** » Fri Nov 19, 2021 6:52 pm

Thanks for letting us know-

I’m not seeing that when I log onto that forum..But we’ll have it looked into…

Ciao..LiO…Peace

Post by **BRoss** » Fri Nov 19, 2021 7:14 pm

stormchaser wrote: Fri Nov 19, 2021 5:57 pm This is the specific file/link in question:

That file it is pointing out is the avatar of a member who is mainly only active in the Nebraska and Iowa forum. The image is no longer found and returns a 404. I don't see anything malicious with it.

Code: Select all

>> curl -v http://vitahound.com/wp-content/uploads/2014/10/Black-Lab-Dog-100x100.jpg
*   Trying 50.87.170.99...
* TCP_NODELAY set
* Connected to vitahound.com (50.87.170.99) port 80 (#0)
> GET /wp-content/uploads/2014/10/Black-Lab-Dog-100x100.jpg HTTP/1.1
> Host: vitahound.com
> User-Agent: curl/7.55.1
> Accept: */*
>
< HTTP/1.1 404 Not Found
< Date: Sat, 20 Nov 2021 01:16:11 GMT
< Server: Apache
< Content-Length: 315
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
</body></html>
* Connection #0 to host vitahound.com left intact

Post by **Brad** » Fri Nov 19, 2021 7:15 pm

I just changed his avatar, see if its better now.

stormchaser · Post by **stormchaser** » Fri Nov 19, 2021 7:23 pm

Brad wrote: Fri Nov 19, 2021 7:15 pm I just changed his avatar, see if its better now.

Just checked again in both normal and incognito mode - no warning message currently so I "think" it's all cleared up. I'll let you know if it ever ends up coming back. Thanks!

bbinks · Post by **bbinks** » Tue Nov 23, 2021 2:11 pm

I'd be happy to see the spam posts from Czechoslovakia or Russia stop.

Post by **Brad** » Tue Nov 23, 2021 6:26 pm

bbinks wrote: Tue Nov 23, 2021 2:11 pm I'd be happy to see the spam posts from Czechoslovakia or Russia stop.

We ban their IP addresses every time, but I'm sure they are spoofing IP addresses like the robo calls do.

Honestly, the way we could eliminate about 90% of the would be to ban gmail email address, and obviously that's not going to happen.

Post by **BRoss** » Tue Nov 23, 2021 7:48 pm

To stop issues we had with slowness and errors in the past, I had to completely block huge ranges of IPs registered overseas.

One problem I've noticed lately though is they are going through AWS servers, which make them appear to be coming from the US.

Original · Post by **Original** » Wed Nov 24, 2021 9:38 am

Another forum I have administered with different software lets you require a valid answer to a simple question to register, and even though it is the most basic possible thing you can imagine related to the topic, it stops enough of the automated registrations that it has been reduced to a manageable level for us. If phpBB lets you implement something like that, as simple as "what is the full name of state is Omaha in?", you may see an additional reduction in automated signups.

Maybe you do that now and I just don't remember since it has been years since I registered.

bbinks · Post by **bbinks** » Wed Nov 24, 2021 4:23 pm

Brad wrote: Tue Nov 23, 2021 6:26 pm
bbinks wrote: Tue Nov 23, 2021 2:11 pm I'd be happy to see the spam posts from Czechoslovakia or Russia stop.
We ban their IP addresses every time, but I'm sure they are spoofing IP addresses like the robo calls do.

Honestly, the way we could eliminate about 90% of the would be to ban gmail email address, and obviously that's not going to happen.

I don't remember if I had to verify my email address when I registered. Not sure if that would even help.

Post by **BRoss** » Thu Nov 25, 2021 2:55 pm

Original wrote: Wed Nov 24, 2021 9:38 am Another forum I have administered with different software lets you require a valid answer to a simple question to register, and even though it is the most basic possible thing you can imagine related to the topic, it stops enough of the automated registrations that it has been reduced to a manageable level for us. If phpBB lets you implement something like that, as simple as "what is the full name of state is Omaha in?", you may see an additional reduction in automated signups.

Maybe you do that now and I just don't remember since it has been years since I registered.

I think it used to be a question, but we had a bunch getting through and switched to captcha a few years back. It may be time to reconsider what we are using. I like the idea of also doing verification emails that bbinks is recommending.

Original · Post by **Original** » Wed Dec 01, 2021 9:37 am

We do captcha along with the question. Our forum is a little more obscure, and has about 1/5th of the traffic here. So maybe not the best comparable, but defense in depth is always good against spam.

Post by **BRoss** » Wed Dec 01, 2021 5:45 pm

Original wrote: Wed Dec 01, 2021 9:37 am We do captcha along with the question. Our forum is a little more obscure, and has about 1/5th of the traffic here. So maybe not the best comparable, but defense in depth is always good against spam.

Looks like you can only use one captcha at a time without some kind of mod. But I just changed it to Q&A with a non-Googlable answer, so we'll see if that makes a difference.

Omaha Forums

Malware on the Site?

Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?

Re: Malware on the Site?