What's going on with samods?

[Theia_Loki]

I just went to samods, and ended up getting this "reported attack site!" warning. forum.samods.org
It could just be me, but does anyone have any idea as to what was going on there and why this happened?

[DrumsofWar]

One of the ads allegedly led to or used some kind of malware but Magic shut it down.  I think another sponsor is using similar tactics now but I'll let Magic know.

That's happened with a lot of websites especially since sponsors can more easily seem respectable.  It should be fixed shortly since the last time was resolved pretty quickly.

[ShadowFlare]

Actually, it sounds like either something in the forum is being exploited or someone has a forum admin's password.  There is an iframe set to hidden that eventually keeps showing up in the forum layout every time someone removes it.  Each time it comes back, it is with another domain going to the same IP address, IIRC.  The site that loads in the iframe runs some kind of Java program.

[FlyingHat]

That is some sneaky stuff.

[Lavarinth]

There was an issue with some code popping up as well. I think it's a multiple of things, including the possibility of getting hack0wn3d.

[tipereth]

Chrome has been giving me random malware alerts for CC recently.

[Mr.]

When I went to SA, for a while, it would randomly say "Would you like to Open or Save "Readme.pdf"?"  And I'd be like "wtf no thx" and then the window would close itself somehow.  How weird is that?

[Krazy]

Some site called q1f.ru was malwaring itself into the forums... I know Magic is aware of the issues and has been trying to resolve it the past few days.

[IskatuMesk]

When I went to SA, for a while, it would randomly say "Would you like to Open or Save "Readme.pdf"?"  And I'd be like "wtf no thx" and then the window would close itself somehow.  How weird is that?

For me it'd just run acrobat reader and do nothing with it. Magic said he had already fixed the malware problem, though.

[ShadowFlare]

I think it may have come back through whatever means it originally got there, though.

Hmm, the current message that Chrome gives is even worse than the previous one.

[DrumsofWar]

I think it may have come back through whatever means it originally got there, though.

Hmm, the current message that Chrome gives is even worse than the previous one.

Yeah, it's not even giving a URL when you first load it, then it gives that .ru domain if you click any internal link.

[RazorclawX]

Eh, who cares... I'm just going to block all of Russia. Not like I can read it anyway.

[Zilla-]

RACIST CAPITALIST AMERICAN PIG-DOG!

[Marco]

RACIST CAPITALIST AMERICAN PIG-DOG!

Capitalism is alive and well in Russia right now, isn't it?

[Lavarinth]

Magic? Fixing something?