Malware on a vendor website

aqua_code · Mar 1, 2020

Hello,

I'm really not sure where to put this. There's a primary vendor that displays lots of ads on reef2reef, and they are embedding malicious content within their website. I tried contacting the vendor but did not receive a response. Does anyone have any recommendations or can a moderator contact me about this? I just want the community here to be protected from it. I'm not worried about it, because I'm able to protect myself, but am concerned about the data privacy of other members.

Here's a virus scan of the malicious link they are embedding.

VirusTotal

www.virustotal.com

Thanks

W1ngz · Mar 1, 2020

The vendor is probably not the one actively doing this, more than likely their site was compromised. They are as much a victim as any site visitors.

MnFish1 · Mar 1, 2020

aqua_code said:
Hello,

I'm really not sure where to put this. There's a primary vendor that displays lots of ads on reef2reef, and they are embedding malicious content within their website. I tried contacting the vendor but did not receive a response. Does anyone have any recommendations or can a moderator contact me about this? I just want the community here to be protected from it. I'm not worried about it, because I'm able to protect myself, but am concerned about the data privacy of other members.

Here's a virus scan of the malicious link they are embedding.

VirusTotal

VirusTotal

www.virustotal.com

Thanks

Seems like the first person to contact would be 'the vendor' - so they can hopefully do something about it?

The Aquatic Arsenal · Mar 1, 2020

#MODS

Bryce M. · Mar 1, 2020

Def got comped, a vendor wouldn't do that

NanoDJS · Mar 1, 2020

There are a few , that do it , or are being spoofed, a really MAJOR one who does live sales almost every week , I have noticed runs the scripts only during the live sales , or banners for them , and on their site while the sale is on. I am pretty sure we are talking about the same guys.

Jeeperz · Mar 1, 2020

NanoDJS said:
There are a few , that do it , or are being spoofed, a really MAJOR one who does live sales almost every week , I have noticed runs the scripts only during the live sales , or banners for them , and on their site while the sale is on. I am pretty sure we are talking about the same guys.

If true, that is messed up and they should be removed or stop the practice. I'm not computer smart at all a rely on honesty that websites do their best to protect our info. There is enough bad in this world

NanoDJS · Mar 1, 2020

Agreed and it should be looked into , I would think with the amount of traffic going through this site to it and its own site somebody in their IT would have resolved it by now, or even noticed this is happening at all ? Thats the truly shocking part, it cant be that 2 site members are the only people who ever noticed them PUMPING trojans into peoples comps.For months now, I have caught them EVERY time they try to infect me, since OCT when coming back the this site. They have had at least 10 live sales since then and have one .......................................................................................................................... So just be warned and get a good anti virus.

Jeeperz · Mar 1, 2020

NanoDJS said:
Agreed and it should be looked into , I would think with the amount of traffic going through this site to it and its own site somebody in their IT would have resolved it by now, or even noticed this is happening at all ? Thats the truly shocking part, it cant be that 2 site members are the only people who ever noticed them PUMPING trojans into peoples comps.For months now, I have caught them EVERY time they try to infect me, since OCT when coming back the this site. They have had at least 10 live sales since then and have one .......................................................................................................................... So just be warned and get a good anti virus.

What's a good antivirus for a smartphone, Android? That's all I use anymore. I don't need my identity stolen, again. Was a year of nothing but hassles the first time.

Jeeperz · Mar 1, 2020

Can we get a name of the vendor so I can avoid the site? PM if you don't want it public, but since it's a security issue I think it should be made public.

Travis Alderman · Mar 1, 2020

Jeeperz said:
What's a good antivirus for a smartphone, Android? That's all I use anymore. I don't need my identity stolen, again. Was a year of nothing but hassles the first time.

Bitdefender. I use it on all my devices from phone to tablet to computer.

sfin52 · Mar 1, 2020

Travis Alderman said:
Bitdefender. I use it on all my devices from phone to tablet to computer.

So what's the site.

aqua_code · Mar 1, 2020

Can we get a name of the vendor so I can avoid the site? PM if you don't want it public, but since it's a security issue I think it should be made public.

Jeeperz and sfin52 sent you a PM. I would rather not post publicly. If anyone else wants to PM me until this thread is closed I can send them the site as well. I'm happy to post once it is resolved. As of this moment it is currently not.

aqua_code · Mar 1, 2020

I also recommend malwarebytes to everyone who needs good malware protection.

Cyber Security Software and Anti-Malware | Malwarebytes

Protect your home and business PCs, Macs, iOS and Android devices from the latest cyber threats and malware, including ransomware.

www.malwarebytes.com

It will block the trojan on this specific vendor. Free for 14 days, but worth it. I use this and ESET smart security.

revhtree · Mar 1, 2020

Please message me so I can reach out to the vendor. Thanks!

Wolf89 · Mar 1, 2020

aqua_code said:
Jeeperz and sfin52 sent you a PM. I would rather not post publicly. If anyone else wants to PM me until this thread is closed I can send them the site as well. I'm happy to post once it is resolved. As of this moment it is currently not.

I'd like a message so I can avoid the vendor. Thank you

jlts21 · Mar 1, 2020

aqua_code said:
Jeeperz and sfin52 sent you a PM. I would rather not post publicly. If anyone else wants to PM me until this thread is closed I can send them the site as well. I'm happy to post once it is resolved. As of this moment it is currently not.

just post it. It's a security issue there is no reason to be secretive about it

infinite0180 · Mar 1, 2020

Me too please!

Jeeperz · Mar 1, 2020

Aqua code pm'd me and gave a very good reason why they won't post it. If someone else wants to post it, like revhtree, then that is their choice but I agree with aqua code's reasoning.

jlts21 · Mar 1, 2020

Jeeperz said:
Aqua code pm'd me and gave a very good reason why they won't post it. If someone else wants to post it, like revhtree, then that is their choice but I agree with aqua code's reasoning.

pm me the name then. I'd also love to know the reasoning that trumps informing everyone so their identity/personal information is not stolen...