4 ms·

All I see is a giant ad for ED pills. This is what I see: https://archive.fo/rZchC https://archive.fo/rZchC over time: https://archive.fo/http://www.shirky.com

All I see is a giant ad for ED pills. This is what I see: https://archive.fo/rZchC https://archive.fo/rZchC over time: https://archive.fo/http://www.shirky.com/writings/ontology_overrated.html https://archive.fo/http://www.shirky.com/writings/ontology_o...

oftenwrong 8y ago
There may be malicious software on your computer.
- jszymborski 8y ago
  this redirected on both GP and archive.fo's servers... I can't replicate, but I think we can rule out malicious software on GP's computer.
  - oftenwrong 8y ago
    That makes sense.
- wslh 8y ago
  I see the same and not malicious software in Android.
nafey 8y ago
Me too. Sibling comment says it might be due to malware. Should I be concerned?
ChuckMcM 8y ago
That is rather odd, on Chrome/Win10 I see the original article, and looking at the page source it seems rather innocuous (no scripts or ad banners etc). What browser and OS are you using?
ghostly_s 8y ago
Same here. Definitely not malware, on an enterprise-managed system. :) DNS hijack perhaps?
mattigames 8y ago
Lack of HTTPS most likely, meaning an infected ISP or alike doing a MITM attack. Interestingly the wayback-machine snapshot is not affected: https://web.archive.org/web/20190123000016/http://www.shirky.com/writings/ontology_overrated.html https://web.archive.org/web/20190123000016/http://www.shirky... After digging a little it seems like the redirection is happening server side (302, 0 bytes e.g. not JS) and its controlled from a malicious site called google-static(.)com, if anybody wanna investigate this further it's this one: http://google-static.com/search/?niche=unknown&page=http%3A%2F%2Fshirky.com%2Fwritings%2Fontology_overrated.html&h=shirky.com&p=%2Fwritings%2Fontology_overrated.html&ref=https%3A%2F%2Fwww.google.co.uk%2F
sevensor 8y ago
I don't think it's malware, at least not on the client. I see the same thing, and I'm using w3m on Linux.
spydum 8y ago
Really common malvertising attack, server is probably compromised: https://www.welivesecurity.com/2013/05/07/linuxcdorked-malware-lighttpd-and-nginx-web-servers-also-affected/ https://www.welivesecurity.com/2013/05/07/linuxcdorked-malwa...
crucialfelix 8y ago
I saw that earlier this morning as well. It's fixed now.

oftenwrong 8y ago

There may be malicious software on your computer.

jszymborski 8y ago
this redirected on both GP and archive.fo's servers... I can't replicate, but I think we can rule out malicious software on GP's computer.
- oftenwrong 8y ago
  That makes sense.
wslh 8y ago
I see the same and not malicious software in Android.

nafey 8y ago

Me too. Sibling comment says it might be due to malware. Should I be concerned?

ChuckMcM 8y ago

That is rather odd, on Chrome/Win10 I see the original article, and looking at the page source it seems rather innocuous (no scripts or ad banners etc). What browser and OS are you using?

ghostly_s 8y ago

Same here. Definitely not malware, on an enterprise-managed system. :) DNS hijack perhaps?

mattigames 8y ago

Lack of HTTPS most likely, meaning an infected ISP or alike doing a MITM attack. Interestingly the wayback-machine snapshot is not affected: https://web.archive.org/web/20190123000016/http://www.shirky.com/writings/ontology_overrated.html https://web.archive.org/web/20190123000016/http://www.shirky... After digging a little it seems like the redirection is happening server side (302, 0 bytes e.g. not JS) and its controlled from a malicious site called google-static(.)com, if anybody wanna investigate this further it's this one: http://google-static.com/search/?niche=unknown&page=http%3A%2F%2Fshirky.com%2Fwritings%2Fontology_overrated.html&h=shirky.com&p=%2Fwritings%2Fontology_overrated.html&ref=https%3A%2F%2Fwww.google.co.uk%2F

sevensor 8y ago

I don't think it's malware, at least not on the client. I see the same thing, and I'm using w3m on Linux.

spydum 8y ago

Really common malvertising attack, server is probably compromised: https://www.welivesecurity.com/2013/05/07/linuxcdorked-malware-lighttpd-and-nginx-web-servers-also-affected/ https://www.welivesecurity.com/2013/05/07/linuxcdorked-malwa...

crucialfelix 8y ago

I saw that earlier this morning as well. It's fixed now.