6

Clicking on the username in a comment by user l'L'l on this question seems to trigger chrome's security alert, stating

Attackers on iplo.ru may trick you into doing something dangerous like installing software or revealing your personal information

The profile link in question: https://stackoverflow.com/users/499581/lll

7

The user's bio contains a hotlinked image from the iplo.ru address. As it's behind a spoiler, and as the iplo.ru domain seems to not point to anything (or maybe it's inaccessible here in the United States), this was hard to find on the page itself.

After browsing the page source with Developer Tools, I discovered the hotlinked image. It seems that Chrome throws this warning whenever any resource is loaded from a blacklisted domain. The warning is confusing, making it seem as if you're trying to browse to that domain itself, and completely misses addressing the crux of the issue (there's a resource behind it).

As Journeyman Geek said, it's worth letting the user know. Ideally, external images would be blocked, but given the current model, this is half the fault of the user for embedding the image, and half the fault of Chrome for the confusing error message. The SE system is not to blame here.

Update: The user has edited out the hotlinked image from their bio. Clicking the link again will no longer result in the warning message.

  • 1
    I can't access it from france or singapore either. – Journeyman Geek Jan 7 at 0:42
  • So you are saying that external images are not normally blocked? – l'L'l Jan 7 at 0:44
  • 1
    @l'L'l No, they are not normally blocked. – Sonic the Anonymous Hedgehog Jan 7 at 0:48
  • 4
    @SonictheAnonymousHedgehog: Interesting, that definitely sets up an attack vector of sorts. – l'L'l Jan 7 at 0:55
  • @l'L'l only in profile page About Me section, the avatar itself can't be external. So the possible damage is not that big. – Shadow The Burning Wizard Jan 7 at 7:42
  • 8
    @JourneymanGeek awesome you went the extra mile to travel to France to verify this ... – rene Jan 7 at 7:46
  • My server is in France. Cheap dedi host I use 😁 – Journeyman Geek Jan 7 at 9:15
4

Looking at the page source - looks like

<img src="https://i.imgur.com/VLNp278.gif" width="440" height="65" alt="l'L'l™" title="l'L'l™"><br /><img src="https://iplo.ru/1QFh87.png">

That's causing it. That's the broken image link on their profile.

enter image description here

Unamusingly, pasting that link, before formatting causes my chrome based browser to throw me the same link. May be worth flagging to let a moderator know, and commenting to let the user know.

Considering the phishing warning - its possible the site might have been compromised.

-2

The profile has been edited and the offending link removed, since this question was asked. The warning was generated by Firefox and Chrome:

Firefox Deceptive Site! Warning

It means that the site is dangerous or deceptive. These sites are often called "phishing" or "malware" sites.

Reports:

  • AnyRun - Offers Malware that overwrites Chrome.exe when installed.

  • CheckPhish - Phishing attempt reported in the last 30 days.

  • ThreatCrowd - Frequently changes website name.

  • AlienVault - Malware reported on Dec 27, 2019.

  • HybridAnalysis - Website name found in Memory Forensics.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .