Something Malicious @ PINBALLNIRVANA?

[Coil_Smoke]

This is a first...This evening I logged on to pinball nirvana forums and my security software blocked the following URL...
http:

//mpe.c m i s o f t w a r e.com/6.jpg

I can't imagine why or where this address came from good ol PINBALLNIRVANA. Of course I'm not going to click on this link(Don't try this at home, try it at some one elses house) A quick search for mpe.cmisoftware got nothing relevant or in the kings English. The description provided by my software says 80% of infectious files come from trusted sites one is used to visiting. This is completely outside of my experience in twelve years of using the ('series of tubes') internet. So I'm wondering if this has ever happened to you others that frequent this site.

 

[sleepy]

Oh yeah. The ".jpg" in the link is the clue. Don't click it.
One of the Bots who plant broken image links probably put that here.
It's a poor trick though. The broken image link to the phony .jpg file has to be clicked to see the image, but there is none. Instead, the exploit sends you to the link and a redirect page to the intended website which can be benign, like an amazon.com where the Bot is mining referral credits in their name, or trying to, else the site is indeed malicious and could load you up.

Awhile ago one of the Bots managed to place an IFRAME in the forum front page script, along with several phony .php files that automated a lot of redirects to a malware site. This was chaos, but Jon got it cleaned up.

 

[sleepy]

I would edit your first post to break that phony image URL since it is still active.

 

[sleepy]

That URL is showing up in the Latest Posts list at the bottom of the forum front page, which is why you are seeing the warning. It was posted by one of our new Bots, the one with the username, "Michael620".

I've already reported him and we are waiting for the admin to arrive.

 

[tiltjlp]

Thanks Sleepy, I zapped the sob.

 

[sleepy]

You need to cripple that URL in the first post because it came from the broken image link and works The Same As The Exploit If You Click it.

 

[tiltjlp]

You need to cripple that URL in the first post because it came from the broken image link and works The Same As The Exploit If You Click it.

I'm a bit slow with the technical stuff, but I think I got it now.