Reported Attack Site
 

For whatever reason Firefox has started trying to tell me that IMFDB is an attack site.

Has anyone else had this warning, and what can we do about it?

Yeah I have the same problem but I just choose the ignore warning option and ran a virus scan which showed no problems for me.

Google is giving a warning about this site. Bunni needs to run a virus sweep of both our site and the adds then get us re registed as being clean.

I'm guessing that we got some bad code in an ad and got the whole site dinged for it.

Yeah I got the warning too and I clicked ignore. Everyone do a virus scan right now

My scan is clean. Notice how they don't tell you where they found the "Virus" on a site if you are an Admin for that site?

We are aware of the issue and are working to find a solution ASAP. Sorry guys!!

This is also my best guess at the moment as everything seems clean after check all the usual suspects. Google is reporting malicious code from outside domains, which would suggest an ad, if the software or server was compromised the malware would be store locally... Funnyjunk.com was also hit with similar malware warnings from similar domains (that's the only thing turning up in google searches for the domains attributed to the malware by google) so I'm thinking they were hit with the same malicious ad.

I've disabled ads for now and requested google review the site and remove the block.

So here is a warning on another site with the same domain, rltk.us, but here it also implicates openx.net as being the source - which ads more evidence to the 'bad ad' hypothesis.

Ok, I've removed all ads and cleared all cached page on the site so that hopefully in a few hours once the google bot comes back through we get a clean bill of health.

Yay, looks like we're clean again (:

Confirmed.

Strike that; it's happened again.

EDIT: And suddenly not. Not sure what happened there.

It keeps coming up for me; either there's a problem on my end or the bad code snuck back in.

Yeah, the "Reported Attack Site" keeps coming back for me as well. I was in the middle of creating a new page of mine, but until this is resolved, I'm not sure it's safe to keep doing so.

It's hard for us to track down which ad causes it due to how specific ad delivery is these days. Every individual sees ads tailored to them. Additionally the ads masquerade as legitimate ads, and load java exploits randomly. Browsers like Chrome and Firefox protect you when this code is detected and don't execute it.

We use two ad networks, AdSense and OpenX, they're as large and legitimate as they come and these issues seem to be hitting quite a lot of large sites right now.

I've looked into analyzing the ad code on our end for exploits before it's served but haven't found anything.

Another strange bug has arisen recently. When I switched to my machine using a 4:3 monitor but did not log in, the main wiki site went into a sort of "safe mode" where frames were not used and only basic HTML text was used, making the site very difficult to navigate. This went away when I logged in, but I'd like to know if anyone else has experienced this bug.

That's not a bug, it's the site's default skin.

That sounds like the css file wasn't being served - my guess would be that file was unavailable at that moment for whatever reason and instead you were just getting plain html text.

This is actually concerning me a little.
 

What is the current listing status for imfdb.org?
This site is not currently listed as suspicious.

Part of this site was listed for suspicious activity 2 time(s) over the past 90 days.

What happened when Google visited this site?
Of the 562 pages we tested on the site over the past 90 days, 48 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-02-03, and the last time suspicious content was found on this site was on 2012-12-23.
Malicious software includes 1 exploit(s).

Malicious software is hosted on 2 domain(s), including iicl.tk/, rltk.us/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including rltk.us/.

This site was hosted on 2 network(s) including AS13335 (CLOUDFLARENET), AS6939 (HURRICANE).

Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, imfdb.org did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.

Yea, it happened again over the weekend. It was the same vector again, an ad from one of our ad providers, openx. Here was their response:

I now have a direct contact within openx to report malicious ads.