Welcome Guest ( Log In · Register · Change Skins )
Global PokedeX Plus
Lab · Shelter · Main · Dex · PC · Shop · Stats · Help · Rules · Users Online · IRC Chat
GPX+ GPXPlus Forums Member Options
X   Site Message
(Message will auto close in 2 seconds)
 
Closed TopicStart new topic
"Phishing Alert" Security Warning
Zerxer
post Aug 31 2015, 03:50 PM
Post #1


Zerkadelic
Group Icon

Group: Root Administrators
Posts: 3 688
Joined: 11-June 07
From: Texas
Member No.: 2

My Favorites



Hi all,

Recently, you may have run into a browser warning while using GPXPlus. As you may have noticed, the URL it's warning you about isn't even for GPXPlus. I'd like to quickly address this.

A few months ago, we had a similar issue where you'd sometimes get automatically redirected to some ad website. This is because the server our site is hosted on had become infected with something that can be virtually impossible to get rid of without completely wiping and rebuilding the server. The main thing this infection would do is hijack a random JavaScript file while it was being loaded off the server, redirecting the request to an external JavaScript file on a very random URL which contained code that told the user's browser to redirect away from GPXPlus and onto the ad site.

While we didn't get rid of the root issue, we did patch it so that it cannot affect any users again: we implemented a Content-Security-Policy header which tells the browser not to load any resources (such as JavaScript files) unless they came from URLs that we trust. So even when the infection would hijack one of our JavaScript file requests and attempt to redirect it to the other file, the browser would automatically prevent the other file from loading, thus preventing it from then redirecting you away from our site.

Now onto the current issue with the phishing warning... it seems that the URL it sometimes attempts to redirect the JavaScript file to is a URL that has previously been flagged by google as a phishing site. Despite the fact that our CSP tells the browser not to even load the URL, the browser is still recognizing it initially and deciding that it should show the phishing warning.

The tl;dr here is that you are completely safe and this Phishing Warning is simply a minor inconvenience that you can safely ignore. However, because the server is still technically infected and it's potentially causing additional issues now, we are ramping up our plan to move to a new host. This will have the benefit of being cheaper and will completely eradicate the infection. Our goal is to be off this server within the next two weeks, but we will let you know if there's any expected downtime.

Thank you.


--------------------
Want a rotating avatar like mine? Check out my website: randimg!
Thanks to all of the people in this thread and this thread for the various avatars!





Go to the top of the page
+Quote Post


Closed TopicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 

Lo-Fi Version Time is now: 28th March 2024 - 07:45 AM
All content and images ©2007-2015 GPX.Plus and Shiny New Software, LLC. Powered By IPB 2.3.1 © 2024 IPS, Inc.
Optimal viewing in the latest version of Safari, Chrome, or Firefox, 1024x768+.