Getting phishing warning in last few pages of General COVID thread

JaysonFour

I was getting up to date with the last few pages of the thread, and suddenly got a popup from Kaspersky warning of a potential phishing link that could host malware on it. I don't know exactly what's causing it, but it's the web address http:// findresults . site /? rpid= 9POR3TG0A (remove spaces but be careful). I'm thinking it might be coming from one of the pictures or something that's been posted, because I can go elsewhere on the forum and not get pinged.

JaysonFour

Also getting this in the first page of the Quarantine Chat thread. I think it's a link in someone's sig or something.

Tube

Can you link to the relevant pages please?

JaysonFour

https://forums.penny-arcade.com/discussion/235845/the-quarantine-chat-thread/p1 - Quarantine Chat thread.

https://forums.penny-arcade.com/discussion/235674/the-general-coronavirus-discussion-thread-mk-ii/p92 - Coronavirus General thread.

Crippl3

Yeah, I've been getting this for a couple days, seemingly in multiple threads. I tend to open up a bunch of threads at once in tabs so I couldn't figure out what it was in, today I went one-at-a-time and got the notification in the latest page of the SE++ Indie Games thread: https://forums.penny-arcade.com/discussion/229998/indie-games-h-o-n-k/p18

It's from "find results dot site", I figure it's probably in someone's sig somehow. Might be multiple users.

Echo

Crippl3 wrote: »

It's from "find results dot site", I figure it's probably in someone's sig somehow. Might be multiple users.

I can't find that in the page source of any of the linked pages. Some browser plugin you're using that's injecting stuff?

JaysonFour

Only plugins I'm using are the Kaspersky-provided one and AdBlock Plus.

BahamutZERO

If you're still getting the warnings, try turning each of them off and trying to trigger the warning again to test them.

e: FWIW I saw some element loading from findresultssite or whatever on the https://forums.penny-arcade.com/discussion/235674/the-general-coronavirus-discussion-thread-mk-ii/p92 page, I don't have this kaspersky plugin that throws warnings though.

Inquisitor77

I'm also getting this for Bitdefender:

Phishing attempt detected
3 hours ago

Feature:
Online Threat Prevention

We blocked this phishing page for your protection:
http://findresults.site/?rpid=9POR3TG0A
Phishing pages attempt to obtain sensitive information such as login credentials or credit card details by disguising as trustworthy entities. The stolen data can be then used for financial gain

Consistently reproduced by visiting this page: https://forums.penny-arcade.com/discussion/231379/streaming-services-you-love-them-you-hate-them-you-have-them-all/p47

Based on past bug reports for these forums, I believe this is related to the alabasterslim.com domain that is being used to host signature images. Interestingly enough, visiting the site itself won't pop up with a warning. It may also be worth nothing that the domain uses straight http and not secured https.

JaysonFour

I mean, I have the same sig, and it's not triggering on this page- if I had to point to anything, I'd say the common thread would be something on Zilla360's signature- they're the only poster who's posted on every single one of the threads that's been giving me these dings, but that's more circumstantial than anything...

Inquisitor77

JaysonFour wrote: »

I mean, I have the same sig, and it's not triggering on this page- if I had to point to anything, I'd say the common thread would be something on Zilla360's signature- they're the only poster who's posted on every single one of the threads that's been giving me these dings, but that's more circumstantial than anything...

This might be it. Zilla's sig contains a link to the following site: https://eu.playstation.com/psn/profile/Cyd0n11a

Going to that link opens up a SSL_ERROR_BAD_CERT_DOMAIN error.

Echo

Inquisitor77 wrote: »

This might be it. Zilla's sig contains a link to the following site: https://eu.playstation.com/psn/profile/Cyd0n11a

Going to that link opens up a SSL_ERROR_BAD_CERT_DOMAIN error.

Well, shame on Sony for mismanaging their certs then. But yeah, that looks like it.

Zilla360

God damnit, Sony. Sorry everyone. :redface:

JaysonFour

Can confirm I am no longer getting the warning. Looks like that was it!