1 May
2024
1 May
'24
1:27 p.m.
Can someone who knows malware please check out the CCL website:
https://www.counterculturelabs.org/
There appears to be malware generating pop ups infecting the site.
I'm sure that someone at Sudo will know exactly what bugspray to use,
thanks.
2 May
2 May
2 a.m.
Hello,
I found two <script> elements that produced the ads in the html for
www.counterculturelabs.com.
One is:
<script async src="https://js.onclckmn.com/static/onclicka.js"
data-admpid="171393"><script type="text/javascript">
and the other is
<script type='text/javascript'
src='//abashfireworks.com/35/f1/c2/35f1c209595f2fcdf8f067a0f5e11d09.js&…
There are other suspicious lines, like:
<link id="wsite-base-style" rel="stylesheet"
type="text/css"
href="//cdn2.editmysite.com/css/sites.css?buildTime=1714421746" />
and I'm sure there's more.
Looks like your site is managed by Weebly. Either your credentials
have been compromised and someone has access to your site, or Weebly
has been compromised in some way.
Log into Weebly and check the edit history.
Alex
On Wed, May 1, 2024 at 1:28 PM Edwinsaurus via sudo-discuss
<sudo-discuss(a)sudoroom.org> wrote:
Can someone who knows malware please check out the CCL website:
https://www.counterculturelabs.org/
There appears to be malware generating pop ups infecting the site.
I'm sure that someone at Sudo will know exactly what bugspray to use, thanks.
_______________________________________________
sudo-discuss mailing list -- sudo-discuss(a)sudoroom.org
To unsubscribe send an email to sudo-discuss-leave(a)sudoroom.org
More options at https://sudoroom.org/lists/postorius/lists/sudo-discuss.sudoroom.org/
2:12 a.m.
Thanks Alex! that's a very thorough analysis.
I found this post on Reddit:
"... spent over an hour with Weebly to discover that a template I was using
on one of the sites was compromised. Changing the template removed the
redirecting code."
https://www.reddit.com/r/Weebly/comments/znjd1n/weebly_websites_being_hacke…
-jake
On Thu, May 2, 2024 at 2:01 AM Alexander Papazoglou via sudo-discuss <
sudo-discuss(a)sudoroom.org> wrote:
Hello,
I found two <script> elements that produced the ads in the html for
www.counterculturelabs.com.
One is:
<script async src="https://js.onclckmn.com/static/onclicka.js"
data-admpid="171393"><script type="text/javascript">
and the other is
<script type='text/javascript'
src='//abashfireworks.com/35/f1/c2/35f1c209595f2fcdf8f067a0f5e11d09.js
'></script>
There are other suspicious lines, like:
<link id="wsite-base-style" rel="stylesheet"
type="text/css"
href="//cdn2.editmysite.com/css/sites.css?buildTime=1714421746" />
and I'm sure there's more.
Looks like your site is managed by Weebly. Either your credentials
have been compromised and someone has access to your site, or Weebly
has been compromised in some way.
Log into Weebly and check the edit history.
Alex
On Wed, May 1, 2024 at 1:28 PM Edwinsaurus via sudo-discuss
<sudo-discuss(a)sudoroom.org> wrote:
Can someone who knows malware please check out the CCL website:
https://www.counterculturelabs.org/
There appears to be malware generating pop ups infecting the site.
I'm sure that someone at Sudo will know exactly what bugspray to use,
thanks.
_______________________________________________
sudo-discuss mailing list -- sudo-discuss(a)sudoroom.org
To unsubscribe send an email to sudo-discuss-leave(a)sudoroom.org
More options at
https://sudoroom.org/lists/postorius/lists/sudo-discuss.sudoroom.org/
_______________________________________________
sudo-discuss mailing list -- sudo-discuss(a)sudoroom.org
To unsubscribe send an email to sudo-discuss-leave(a)sudoroom.org
More options at
https://sudoroom.org/lists/postorius/lists/sudo-discuss.sudoroom.org/
3:35 a.m.
Looks like I may have found the source of the problem. The SEO page was
hacked to add malware links in the header and footer:
[image: image.png]
This blog post on Finding & Removing Malware on Weebly Sites turned out to
be quite useful:
https://blog.sucuri.net/2023/01/finding-removing-malware-from-weebly-sites.…
And their SiteCheck web server did flag our website as containing malware:
https://sitecheck.sucuri.net/results/counterculturelabs.org
[image: image.png]
On Thu, May 2, 2024 at 2:13 AM Jake Watters via sudo-discuss <
sudo-discuss(a)sudoroom.org> wrote:
Thanks Alex! that's a very thorough analysis.
I found this post on Reddit:
"... spent over an hour with Weebly to discover that a template I was
using on one of the sites was compromised. Changing the template removed
the redirecting code."
https://www.reddit.com/r/Weebly/comments/znjd1n/weebly_websites_being_hacke…
-jake
On Thu, May 2, 2024 at 2:01 AM Alexander Papazoglou via sudo-discuss <
sudo-discuss(a)sudoroom.org> wrote:
Hello,
I found two <script> elements that produced the ads in the html for
www.counterculturelabs.com.
One is:
<script async src="https://js.onclckmn.com/static/onclicka.js"
data-admpid="171393"><script type="text/javascript">
and the other is
<script type='text/javascript'
src='//abashfireworks.com/35/f1/c2/35f1c209595f2fcdf8f067a0f5e11d09.js
'></script>
There are other suspicious lines, like:
<link id="wsite-base-style" rel="stylesheet"
type="text/css"
href="//cdn2.editmysite.com/css/sites.css?buildTime=1714421746" />
and I'm sure there's more.
Looks like your site is managed by Weebly. Either your credentials
have been compromised and someone has access to your site, or Weebly
has been compromised in some way.
Log into Weebly and check the edit history.
Alex
On Wed, May 1, 2024 at 1:28 PM Edwinsaurus via sudo-discuss
<sudo-discuss(a)sudoroom.org> wrote:
_______________________________________________
sudo-discuss mailing list -- sudo-discuss(a)sudoroom.org
To unsubscribe send an email to sudo-discuss-leave(a)sudoroom.org
More options at
https://sudoroom.org/lists/postorius/lists/sudo-discuss.sudoroom.org/
Can someone who knows malware please check out the CCL website:
https://www.counterculturelabs.org/
There appears to be malware generating pop ups infecting the site.
I'm sure that someone at Sudo will know exactly what bugspray to use,
thanks.
_______________________________________________
sudo-discuss mailing list -- sudo-discuss(a)sudoroom.org
To unsubscribe send an email to sudo-discuss-leave(a)sudoroom.org
More options at
https://sudoroom.org/lists/postorius/lists/sudo-discuss.sudoroom.org/
_______________________________________________
sudo-discuss mailing list -- sudo-discuss(a)sudoroom.org
To unsubscribe send an email to sudo-discuss-leave(a)sudoroom.org
More options at
https://sudoroom.org/lists/postorius/lists/sudo-discuss.sudoroom.org/
15
days inactive
16
days old
3 comments
4 participants
participants (4)
-
Alexander Papazoglou -
Edwinsaurus -
Jake Watters -
Patrik D'haeseleer