Hello. Every now and then (it occasionally goes away) the Data Realms site is apparently being reported for distributing malware. Either someone's being silly, or there's a problem I haven't noticed yet.



I'm using Opera, this is just the built-in malware warning thingy. This has been going on for a few months now. I've bypassed this warning and unless Avast fails me, I haven't been infected with anything.

Interesting that you say this.

I am having great issues reaching this site for almost a week now and at one point I contacted my ISP about it.
They mentioned their system checked this site out to be a... non-trustable website, to put it kindly.

Although I believe it to be nonsense ofcourse, it's strange that it came from the number one ISP in my country. :S

The first time I saw it, I went to the AVG site and sent a "False Positive" report. I'd do it again, but frankly, now that it's up again I'm kind of wary of doing that.

Investigation is warranted, methinks. It could just be an angry person/group trying to mess with the site by sending bogus reports, but it's better to be safe.

By the way, the forums are being fairly slow for me. Anyone else getting that?

Honestly I'm starting to think someone is doing all they can to ♥♥♥♥ up the forums. I've never seen it this slow except when DRL was being DDoS'd way back when. And considering we've never gone over 130 or so users on at any one time and not had problems, I'm inclined to think that the recent "heavy" traffic from B27 isn't the problem.

it's definitely the mysqldb being unmaintained. the forums as well as the wiki will error out every now and then because the mysql config is not configured correctly atm.

reports of malicious site is from the security groups downloading any binaries automatically(this includes the CC installer from the front page), and getting that false-positive that some people are apparently getting.

Not entirely related but in case it helps anyone with the relevant know-how, I'm unable to upload attachments and get the following error message. I haven't yet confirmed if this is the same problem Gotcha's suffering from (he's also unable to upload attachments) but either way I hope it helps:

By the way, I'd like to encourage everyone to file an Incorrect Page Rating Report, as this does harm the website and it's certainly not legitimate.

If this is from automatically downloading binaries, how come it's taken so long for this warning to pop up? I still think some nonsense is afoot.

My problem is definitely different, due to the fact that I can't reach the forum -at all-, except through proxy websites. ;_;

Previous releases didn't trigger the false-positive b27 has.

This warning came up before B27 was out. Since a little before the "Finishing the tech implementations" video, in fact.

I just got this email. Now I'm a little worried about what this actually does, and whether or not I need to worry about my machine. Can anyone tell what it does?

Further, is anyone forwarding this to the relevant people? I don't know who the website people are for DR, and I certainly want this fixed as much as anyone.

Yeah, we know about it.

Forwarded the response to data, btw.

I've seen some shady third-party sites in the noscript list of the main page now and then; just now I saw "http://prostofoto.eu" there, now it's gone though.
They seem to be "It works!" leaseweb sites. Suspicious.

Hahahaha, lol, haHAAHAHAhaha. That's great. Hope the server is properly secured, I.E. apache is run on a separate user that only has access to what it needs to have access to. Is payment information stored in a database whose credentials are readable by the same user running apache that serves the infected page? That's pretty probable.

I don't think datarealms runs any ads, does it? That'd mean there's an actual security hole. That's a shame. Anyone get the full javascript? It apparently only appears once per IP.

e: betting the vulnerability they used is the devlog's wordpress timthumb file.

here, data: http://markmaunder.com/2012/04/23/intro ... ty-plugin/



If you get the full URL that is accessed you'll see that the result is a blackhole kit that runs checking for any vulnerable plugins you're using, and exploiting any found holes to add you to a botnet.