Alert: Forum Redirected to Dangerous Site
-
I've done my little investigation and maybe this could help admins.
I suspect that it's user "Kaiokenred" who managed to hack some files at some point in time, in order to hide his posts. This forum redirects to the other forum whenever you access his posts, or his profile.
I have checked the other forum (I don't recommend it) and I can tell you that it's just a simple forum for a special kind of internet retardation, a higher form of anime fandom. currently dead and possibly hacked. the guy was possibly a member there based on the theme of his username.admin should check .htaccess file and other files for any scripts left by the hacker, as I think the web server was hacked at some point in time and the perpetrator left a script or two there. This could explain the database losses that the forum faced before if someone attempted to delete things right of the database.
Read more here to know what you're looking for.
-
I visited this forum via google just now and never got any alert, using Chrome. Anyone else?
Only odd thing was google took me to https//www.free-minds.org/forum/ and not https//free-minds.org/forum/index.php
I tried it. Looks like Chrome blocked some kind of script. I clicked the icon on right and only then the site loaded normally. But now again it is marking the https in red and saying the site is not secure. I am seeing this throughout the pages. Sometimes it is secure and sometimes not secure.
I've done my little investigation and maybe this could help admins.
I suspect that it's user "Kaiokenred" who managed to hack some files at some point in time, in order to hide his posts. This forum redirects to the other forum whenever you access his posts, or his profile.
I have checked the other forum (I don't recommend it) and I can tell you that it's just a simple forum for a special kind of internet retardation, a higher form of anime fandom. currently dead and possibly hacked. the guy was possibly a member there based on the theme of his username.admin should check .htaccess file and other files for any scripts left by the hacker, as I think the web server was hacked at some point in time and the perpetrator left a script or two there. This could explain the database losses that the forum faced before if someone attempted to delete things right of the database.
Read more here to know what you're looking for.
Was Kaiokenred a member here?
-
Why would an anime forum hack this forum?
There's no money, or were they going to blackmail database for bitcoin? -
Why would an anime forum hack this forum?
There's no money, or were they going to blackmail database for bitcoin?He seems to be a fan of anime. I got your PM. Will reply soon.
Yes, I believe Wakas just deleted that user and all his posts. that should take care of all the links that referred to the other forum.
Though there might be more users or posts affected by whatever script was injected in the server files.I googled his name with free-minds keyword. Strangely, even that takes me to that same orange page of warning. Does he own servantoflight.com?
-
I didin't really think it was Kaoikenred (or whatever weird username he has) until I checked his profile and I too get redirected to that anime page but reading the source code his profile says he was last online 5 years ago? You'd think he would at least be online recently if he was behind it? I remember checking his profile many months ago and I didin't get redirected to that page then? I see his profile img (a gif) is being hosted by/loaded from that webpage (henshinjustice or whatever it's called) which could explain why that error is coming up when you visit his profile. When you visit the page called henshinjustice you get that pishing warning from Google so it's kinda being led to his profile too as he's loading the image from that site. There's a thread on that webpage started by some guys regarding how the Forum is getting the deceptive site warning thing from Google
But this doesn't explain why you're getting that error reel. What topic is it that you're visiting in the url? And has Kaoikenred written a post in that topic? Then that could explain why the error is showing up. Check other topics Kaoikenred has written in and see if that error comes up. Anyway if it's indeed Kaoikenred then a way to solve this error I'd say is to remove his profile picture he's using as it's being loaded from that page and bringing the warning along with it.
-
I didin't really think it was Kaoikenred (or whatever weird username he has) until I checked his profile and I too get redirected to that anime page but reading the source code his profile says he was last online 5 years ago? You'd think he would at least be online recently if he was behind it? I remember checking his profile many months ago and I didin't get redirected to that page then? I see his profile img (a gif) is being hosted by/loaded from that webpage (henshinjustice or whatever it's called) which could explain why that error is coming up when you visit his profile. When you visit the page called henshinjustice you get that pishing warning from Google so it's kinda being led to his profile too as he's loading the image from that site. There's a thread on that webpage started by some guys regarding how the Forum is getting the deceptive site warning thing from Google
But this doesn't explain why you're getting that error reel. What topic is it that you're visiting in the url? And has Kaoikenred written a post in that topic? Then that could explain why the error is showing up. Check other topics Kaoikenred has written in and see if that error comes up. Anyway if it's indeed Kaoikenred then a way to solve this error I'd say is to remove his profile picture he's using as it's being loaded from that page and bringing the warning along with it.
OOOOh, now I get it. It is his profile pic link which probably is infected and needs to be removed. Chrome is being over sensitive these days though. I noticed google removed his page from cache.
The whole thing just suddenly happened yesterday when a keyword took me to free-minds. But I believe google might have sent an email to webmaster tools of admin about the problem.They usually do that.
-
Yep it worked
-
I have removed the pic. Try now.
Yes, it worked. Thanks yay
Ah I guess I blamed Kaiokenred for something he didn't do, my apology to you and everyone else.
Ah I guess I blamed Kaiokenred for something he didn't do, my apology to you and everyone else.
No, don't be sorry. You found the clue. Without it, it would have not been possible. Thanks )
-
I get this message (I translated it with google-translate from dutch) when trying to visit the site
Your connection is not private
Attackers try to steal your information from free-minds.org (e.g., passwords, messages, or credit card details). NET ERR_CERT_DATE_INVALID
Automatically send certain system information and page content to Google to help detect dangerous apps and sites. Privacy Policy
Return to secure website DETAILED INFORMATION
This server can not prove that this is free-minds.org. The corresponding security certificate expired yesterday. This may be caused by an incorrect configuration or attacker intercepting your connection. Your computer's clock is currently set on Tuesday, July 11, 2017. Is that correct? If not, you need to adjust the clock of your system and then refresh this page. More information.Continue to free-minds.org (unsafe)
-
Salam Brother Bender im getting the same message aswell and notice some png is not showing.
-
Peace All.
I have got the warning also , since I was given the choice to carry on or not, I ignored it and got through .
Wakas,can I have permission from admin to copy some of my posts into my website?
Thank you.
GOD bless you all.
Peace. -
Thank you brother.
Free minds site is now back to normal. I am not getting the warning any more.
GOD bless you.
Peace.
