Site security WARNING

[Tincon]

The new member: "Jeffe79ryey" has certain smileys in all of his posts. These resemble the normal graphics used on this site, however they actually link to an external webpage:http://rievera.bewegundm.com

This site appears to be attempting to run malicious code. I'm not what the intent behind this is, but it seems very suspicious and I thought members and site staff should be aware.

Example: http://www.calguns.net/calgunforum/s...&postcount=202

[Best sale]

hopefully he will be suspended from calgun until he can explain his mission FTF with senior calguns members that stays around his zone..

smells like a RATA got to be a sewage Rata.... I hope I am wrong jeffe79ryey

btw .....Good looking out Tincon

[Josh Smith]

Hello,

I'm exploring this.

The thread specified is no longer up, but I visited that website.

I have very tight security on this computer, and I see nothing malicious on that website. Just looks like some feller's collection of smileys; I had one once, too, but used Photobucket to host them.

Just my take on what little I'm seeing.

Did the content of the posts make sense?

Regards,

Josh

[Tincon]

It's happening again, new user: "olsonlao"

The posts make too much sense to be a bot, but the smileys are out of place. Example: http://www.calguns.net/calgunforum/s...8&postcount=24

I'd say it's definitely an intelligent and targeted attack, which is still ongoing.

[cabinetguy]

My internet security software has been blocking malicious code from that website.

[gunnerstuff]

I was wondering why the images showed as broken, but you are correct the website is blocked by my AV software.

[bob7122]

i won't click on the link but you guys can click on the red triangle with a black line and report it as malicious software.

[ke6guj]

It's happening again, new user: "olsonlao"

The posts make too much sense to be a bot, but the smileys are out of place. Example: http://www.calguns.net/calgunforum/s...8&postcount=24

I'd say it's definitely an intelligent and targeted attack, which is still ongoing.

that is because they repost other peoples posts in the same thread. I've reported a couple of these guys in the last week.

here's the original post.

^^ lol. This guy.

Tagging to become one when I get home.

[ocabj]

The domain name is registered in China, but the host the domain is parked on is in Canada.

[Aldemar]

I don't remember ever clicking on a smiley.

[ILVH8RS]

I;m not gonna chance clicking on any possible harmful links on my work computer but thanks for the heads up.

[r31ncarnat3d]

Hope you guys don't mind a newbie commenting on this.

I checked out his site and I couldn't find malicious code. I checked the source code on both his image repo and the parent site.

That said, while rievera.bewegundm looks like just a normal image repo, the parent site bewegundm looks extremely suspicious. It looks like some sort of wordpress site. Running the blog posts through a translator shows that it's all advertisement spam. Furthermore, the site is written in German but WHOIS shows the domain is registered to someone in China.

Disclaimer: I have no background in NetSec so hopefully someone who does work in the field can come in here to explain. If I had to venture a guess though, it looks to me like he's trying to spam hits to his site where he either gets money on clickthroughs or on people buying what he's peddling. Not infecting people with malicious code, but not kosher either.

Some pics to show examples so y'all don't have to visit his site:

[Tincon]

i won't click on the link but you guys can click on the red triangle with a black line and report it as malicious software.

I reported each one and this thread, it looks like they were cleaned up not long after. Keep an eye out for unusual smileys though, and report them or post here if you see something.

The domain name is registered in China, but the host the domain is parked on is in Canada.

Chinese hackers no doubt.

I don't remember ever clicking on a smiley.

You don't have to, your browser automatically loads them. If this keeps up, it may be worth not allowing external image links (require the image to be uploaded/attached here). But I'm not sure how dangerous this code really is. Something is up for sure though.

[najay]

the external images can just be a mechanism to capture active ip addresses

[bigcalidave]

Don't click on links you don't know or trust. Simple!