New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
i don't know what you expect us to do about that
ban them
just ignore and proceed and report it to cf as a false positive.
Cloudflare is really bad about this. They flagged our homepage as phishing a few months back due to a false report. It's been 6 weeks and they still haven't reviewed our appeal or responded to us. We ended up switching CDNs after a week.
@spectraip
It looks like this goes beyond just Cloudflare, ESET and a dozen other AVs are flagging their javascript files as malicious.
If you look at their main.js for example, it looks like it's been maliciously modified, the bottom shows:
edit: Seems like it's closely related to this NDSW/NDSX malware campaign from ~2021/2022. Wayback machine shows that the javascript files on spectraip's site has been compromised since at least May 28, 2024.
Ideally it is supposed to work like this:
But animate.php seems to actually not exist, I tried hitting it with generated strings and couldn't get anything but a 404. Something like "m5x7a9b3f0z2k4l1j6h8" as the id parameter should return a value.
My guess, their install was compromised at some point in the past, the animate.php was cleaned/removed, but the javascript still remains.
@spectraip
Nothing New! Cloudflare is terrible, just use DNS mode only
Not sure why Cloudflare is getting the blame here.
Because they are notorious for flagging legit sites as phishing based on malicious and baseless reports (even if it is not the case here).
That's why you email CF VPs the day it happens. Worked for me.
spectraip.com != spectraip.net
Reguards.
oh.. well that's a brand disaster.
for what it's worth, spectraip.net is also flagged on ESET, but not due to the malicious javascript files above, but rather the IP being on their blacklist.
other endpoints are not blacklisted, for example, dedicated.spectraip.net which is on 91.230.49.10 rather than 91.230.49.1 like the primary .net.
That's not fun, hopefully it gets sorted soon.
They solved it. Spectraip is a very good hosting company.
Yeah Lucas Walter is a good guy. LOL
but 0 support, if you had service with SKB-Enterprise / Phanes Cloud they ripped people off scamming them and providing 0 services
I paid renewal for 3 domains with SKB Enterprise and they vanished with the invoice after fews days, no one replies to tickets/email and if they did they do after half a year
was lucky to transfer them out directly because they never renewed my domains