Mastodon Skip to content
  • Home
  • Aktuell
  • Tags
  • Über dieses Forum
Einklappen
Grafik mit zwei überlappenden Sprechblasen, eine grün und eine lila.
Abspeckgeflüster – Forum für Menschen mit Gewicht(ung)

Kostenlos. Werbefrei. Menschlich. Dein Abnehmforum.

  1. Home
  2. Uncategorized
  3. I have confirmed archive.ph, which archive.today redirects to, has malicious code which attempts to spam gyrovague.com with requests.

I have confirmed archive.ph, which archive.today redirects to, has malicious code which attempts to spam gyrovague.com with requests.

Geplant Angeheftet Gesperrt Verschoben Uncategorized
28 Beiträge 15 Kommentatoren 0 Aufrufe
  • Älteste zuerst
  • Neuste zuerst
  • Meiste Stimmen
Antworten
  • In einem neuen Thema antworten
Anmelden zum Antworten
Dieses Thema wurde gelöscht. Nur Nutzer mit entsprechenden Rechten können es sehen.
  • iampytest1@infosec.exchangeI This user is from outside of this forum
    iampytest1@infosec.exchangeI This user is from outside of this forum
    iampytest1@infosec.exchange
    schrieb zuletzt editiert von
    #21

    @creaturr Both of them have the malicious script.

    1 Antwort Letzte Antwort
    0
    • bette@mstdn.socialB bette@mstdn.social

      @iampytest1

      The next time it happens, sure. I quit my browser and opened it again, hoping to be able to do that, but it failed to appear (of course). It was a stand-alone, btw, it was the only thing on the screen, the browser wasn't open yet.

      tanh@mastodon.socialT This user is from outside of this forum
      tanh@mastodon.socialT This user is from outside of this forum
      tanh@mastodon.social
      schrieb zuletzt editiert von
      #22

      @Bette @iampytest1

      Do you have this browser extension installed?

      https://addons.mozilla.org/en-US/firefox/addon/archive-page/

      It received an update in the last couple of days and it probably opens a changelog when your browser gets around to updating it.

      bette@mstdn.socialB 1 Antwort Letzte Antwort
      0
      • tanh@mastodon.socialT tanh@mastodon.social

        @Bette @iampytest1

        Do you have this browser extension installed?

        https://addons.mozilla.org/en-US/firefox/addon/archive-page/

        It received an update in the last couple of days and it probably opens a changelog when your browser gets around to updating it.

        bette@mstdn.socialB This user is from outside of this forum
        bette@mstdn.socialB This user is from outside of this forum
        bette@mstdn.social
        schrieb zuletzt editiert von
        #23

        @tanh @iampytest1

        Ding, ding, ding! That seems to be the case. I'll be turning that off now. Thank you so much!!

        1 Antwort Letzte Antwort
        0
        • iampytest1@infosec.exchangeI iampytest1@infosec.exchange

          I have confirmed archive.ph, which archive.today redirects to, has malicious code which attempts to spam gyrovague.com with requests. The code I independently verified matches the code in the Hacker News post.

          Behind CloudFlare: https://tria.ge/260116-d3jafadj81/behavioral1

          Do not use archive.today, archive.is, and archive.ph. By accessing these websites, you are donating your bandwidth to a botnet of unknown origin and purpose.

          Original source:
          https://social.coop/@eb/115902323900229756

          An emergency update to the Malicious Website Blocklist has been made to counter this threat. An emergency update is currently in the works to fix the emergency update as it is in the wrong place (I want to link to this toot in the update, so waiting to commit until I post).

          iampytest1@infosec.exchangeI This user is from outside of this forum
          iampytest1@infosec.exchangeI This user is from outside of this forum
          iampytest1@infosec.exchange
          schrieb zuletzt editiert von
          #24

          As someone pointed out in the comments, this is not limited to archive[.]ph. Other archive.today domains have the malicious code.
          I don't want to update the initial post as that will send a ping to every single person who liked or boosted it.

          R 1 Antwort Letzte Antwort
          0
          • iampytest1@infosec.exchangeI iampytest1@infosec.exchange

            As someone pointed out in the comments, this is not limited to archive[.]ph. Other archive.today domains have the malicious code.
            I don't want to update the initial post as that will send a ping to every single person who liked or boosted it.

            R This user is from outside of this forum
            R This user is from outside of this forum
            risottobias@toot.risottobias.org
            schrieb zuletzt editiert von
            #25

            @iampytest1 I do like the update/toot-edit pings ❤ you're doin' just fine 🙂

            1 Antwort Letzte Antwort
            0
            • iampytest1@infosec.exchangeI iampytest1@infosec.exchange

              I have confirmed archive.ph, which archive.today redirects to, has malicious code which attempts to spam gyrovague.com with requests. The code I independently verified matches the code in the Hacker News post.

              Behind CloudFlare: https://tria.ge/260116-d3jafadj81/behavioral1

              Do not use archive.today, archive.is, and archive.ph. By accessing these websites, you are donating your bandwidth to a botnet of unknown origin and purpose.

              Original source:
              https://social.coop/@eb/115902323900229756

              An emergency update to the Malicious Website Blocklist has been made to counter this threat. An emergency update is currently in the works to fix the emergency update as it is in the wrong place (I want to link to this toot in the update, so waiting to commit until I post).

              lufthans@mastodon.socialL This user is from outside of this forum
              lufthans@mastodon.socialL This user is from outside of this forum
              lufthans@mastodon.social
              schrieb zuletzt editiert von
              #26

              @iampytest1 Is the malicious traffic being triggered from JavaScript or CSS? Something else?

              iampytest1@infosec.exchangeI 1 Antwort Letzte Antwort
              0
              • lufthans@mastodon.socialL lufthans@mastodon.social

                @iampytest1 Is the malicious traffic being triggered from JavaScript or CSS? Something else?

                iampytest1@infosec.exchangeI This user is from outside of this forum
                iampytest1@infosec.exchangeI This user is from outside of this forum
                iampytest1@infosec.exchange
                schrieb zuletzt editiert von
                #27

                @lufthans JavaScript.
                The code is here: https://social.coop/@eb/115902412468711646

                1 Antwort Letzte Antwort
                0
                • iampytest1@infosec.exchangeI iampytest1@infosec.exchange

                  I have confirmed archive.ph, which archive.today redirects to, has malicious code which attempts to spam gyrovague.com with requests. The code I independently verified matches the code in the Hacker News post.

                  Behind CloudFlare: https://tria.ge/260116-d3jafadj81/behavioral1

                  Do not use archive.today, archive.is, and archive.ph. By accessing these websites, you are donating your bandwidth to a botnet of unknown origin and purpose.

                  Original source:
                  https://social.coop/@eb/115902323900229756

                  An emergency update to the Malicious Website Blocklist has been made to counter this threat. An emergency update is currently in the works to fix the emergency update as it is in the wrong place (I want to link to this toot in the update, so waiting to commit until I post).

                  merospit@infosec.exchangeM This user is from outside of this forum
                  merospit@infosec.exchangeM This user is from outside of this forum
                  merospit@infosec.exchange
                  schrieb zuletzt editiert von
                  #28

                  @iampytest1 I have never trusted the archive.* sites. Too much weirdness involving high entropy DNS queries and both mail[.]ru and google scripts when I looked into it. But nothing like this in the past.

                  1 Antwort Letzte Antwort
                  0
                  • skorpy@chaos.socialS skorpy@chaos.social shared this topic
                  Antworten
                  • In einem neuen Thema antworten
                  Anmelden zum Antworten
                  • Älteste zuerst
                  • Neuste zuerst
                  • Meiste Stimmen



                  Copyright (c) 2025 abSpecktrum (@abspecklog@fedimonster.de)

                  Erstellt mit Schlaflosigkeit, Kaffee, Brokkoli & ♥

                  Impressum | Datenschutzerklärung | Nutzungsbedingungen

                  • Anmelden

                  • Du hast noch kein Konto? Registrieren

                  • Anmelden oder registrieren, um zu suchen
                  • Erster Beitrag
                    Letzter Beitrag
                  0
                  • Home
                  • Aktuell
                  • Tags
                  • Über dieses Forum