Why some links in this forum have dangerous notice from Google Chrome

[MaXi32]

Just be careful with some links in this forum. For example, this thread is flagged by Google Chrome as a dangerous link and you got a redirect link to dabackup.com which is not a trusted link. https://forum.directadmin.com/threads/where-is-proper-backup-system.61216/ ( I use proxy the site is OK, with other connection I got this notice. Looks like SSL stripping attack)

Edit

I think maybe something is wrong on how the forum link was populated. Maybe Xenforo issue ?

 

[Richard G]

Just be careful with some links in this forum.

One should be careful with links in *any* forum.
Firefox also blocks that link also via Google Safe Browsing.

Anyway it's not a DA forum issue, the problem takes place when you want to visit that link.

I think maybe something is wrong on how the forum link was populated. Maybe Xenforo issue ?

What do you mean? If I'm correct then Xenforo uses php to read some index, not a browser, so it won't be blocked by any safe browsing protection.
It doesn't check for malware or kindlike as far as I know.

 

[MaXi32]

One should be careful with links in *any* forum.
Firefox also blocks that link also via Google Safe Browsing.

Anyway it's not a DA forum issue, the problem takes place when you want to visit that link.

What do you mean? If I'm correct then Xenforo uses php to read some index, not a browser, so it won't be blocked by any safe browsing protection.
It doesn't check for malware or kindlike as far as I know.

No, I mean when I click the link on thread title: https://forum.directadmin.com/threads/where-is-proper-backup-system.61216/ , and it straight away shows that error message. I think that someone might be doing ssl stripping here and targetting random users (maybe). Meaning that from DA website link that I mentioned above, after I clicked on that -> I got redirected to dabackup.com but being blocked by chrome. When I use proxy to visit the above site, I don't see any dangerous error. So it's targeting my IP or maybe random users. when I use a proxy, I can see the content of the website made by @desfire contains the link dabackup.com.. So I guess, xenforo might populated that link (that contains https) on the thread's title.

 

[MaXi32]

I still got that dangerous message (happen randomly). See this video:

https:// www. youtube. com /watch?v= 5zGvOXgSGng


Maybe @syslint might have something to say about this because it's pointing to their domain.

 

[Richard G]

No, I mean when I click the link on thread title: https://forum.directadmin.com/threads/where-is-proper-backup-system.61216/ , and it straight away shows that error message.

I don't have that with Chrome. I reallyl have to click that infected link to get that screen. Or.... it didn't before. Now it does.
So indeed looks randomly. Maybe the browser does not always check links. Didn't have it with Firefox yet when visiting the main link.

I'm also curious as to any insight of @syslint.

P.s. video is not available, neither on YT.

 

[MaXi32]

P.s. video is not available, neither on YT.

I could not embed a youtube video here, I have to separate that link. So, you have seen that error too. I also got the same error on another link but I forgot. Not sure if this is bug or someone is spying here.

 

[Richard G]

Please don't quote full messages, especially not if you answer right below... keeps things more clear.

Hmmz... seems indeed that DA might have disabled this.
I tried with a couple, but every time same error.

 

[MaXi32]

At first I thought im the only one saw that error. Now because this affected others, so DA team must investigate this @smtalk .

 

[ikkeben]

@MaXi32 tou are right with this

So I guess, xenforo might populated that link (that contains https) on the thread's title.

IN FF with some addons link goes to normal da forum but at cert ssl info saying not protected parts as images... that is why i don't like external images in such important forum is this for admins is noway secure enough.

Also some simple other rules are not..https://observatory.mozilla.org/analyze/forum.directadmin.com

Scan results for forum.directadmin.com

These are the scan results for forum.directadmin.com which scored the grade D.

securityheaders.com

With chrome that warning and no i don't folow it to dabackup... problem is on that topic then in forum this link there to this site with some short info (framed)

Google Transparency Report

transparencyreport.google.com

Current status
warningThis site is unsafe
The site https://dabackup.com/images/favicon.ico contains harmful content, including pages that:

• Try to trick visitors into sharing personal info or downloading software

 

[MaXi32]

@ikkenben

Might be from the link inside that post, but still I don't understand why it happens randomly. In addition, when I use proxysite.com with that link, I don't have that error.

 

[MaXi32]

@ikkenben

In addition, when I use proxysite.com with that link, I don't have that error.

OK now I understand.. Google Chrome could not detect that because the proxysite.com was served as a valid https for its site but the suspicious link is displayed inside a frame, So Google Chrome could not detect it. but that random error seen by Richard and me make me wonder why.

 

[ikkeben]

OK now I understand.. Google Chrome could not detect that because the proxysite.com was served as a valid https for its site but the suspicious link is displayed inside a frame, So Google Chrome could not detect it. but that random error seen by Richard and me make me wonder why.

It is live so maybe the info is from different "chrome/google" servers , where some have and some don't have this site / link as bad...

 

[Tommyhara]

This error may be xenforo system, the member could insert their website link and this system redirected to their site and caused that error. Forum admin needs to delete that thread and remove the user posted that thread.