Anyone seen this in GWT before

Attention do NOT visit this link!!!
Btw,this "page" try to drop JS:Miner-C[TRj]


HI Guys,
Just checking in Webmaster Tools under links and found this one. xxxhttp://gpwa-www.9x.si

Anyone else seen it before and should I disavow straight away?

Logoff - before u visit this link!!!

Btw,this "page" try to drop JS:Miner-C[TRj]

Typical bitcoin trojan from coinhive....

Regards

Too late Progger, I visited the link already. So I should disavow then, I guess all members should check their link profiles

Change your pass https://www.gpwa.org/forum/profile.php?do=editpassword

Thanks Progger

Quote:

---

Originally Posted by Progger

Logoff - before u visit this link!!!

---

Isn't it time the GPWA had SSL

Yes,but ssl dont solve this problem...because its iframe..

<frameset rows="*,110" frameborder="NO" border="0" framespacing="0">
<frame name="main" src="https://www.gpwa.org/">
<frame name="ad" src="http://xxxxxxx/banner/header.htm" noresize scrolling="no">


Header always append X-Frame-Options SAMEORIGIN can solve this problem...

Agreed. But AFAIK if the forum was SSL, then passwords and other sensitive data wouldn't be sent in plain text, instead it's encrypted.

The fun never ends. How smart is Trojan bitcoin miner... genius but evil.

Thanks Progger, I will add a disclaimer to the original post as I think we should WARN folks NOT to visit the link in case they try to visit before seeing Progger's post as well as the rest of the thread.

Rick
Universal4

Quote:

---

Originally Posted by muffincrumbs

The fun never ends. How smart is Trojan bitcoin miner... genius but evil.

---

Yes ,is a new trend...the visitor can allow the miner to eat the whole system resources,and the page owner can get some cents for his work.
But many webmasters prefer to drop a Trojan...without one question..

I bet Sherlock know more about this...:)

https://motherboard.vice.com/en_us/a...-far-this-year

Sorry for posting the link, I had no idea what it was or could do

Quote:

---

Originally Posted by PromoteCasino

Sorry for posting the link, I had no idea what it was or could do

---

Don't be sorry. We all make mistakes.

I put the miner on one of my sites, people were bitc hing, well I told them affiliate business is slow, you know... But was not worth of money, got 1 XMR or so.

Since I am scared to click, I have no idea what is going on. The miners are javascript miners and they are not dangerous. They just mine when user is on certain page and you see it because your laptop fan goes crazy. Once you go off the page, it stops.

The iframes are being used to avoid adblocks, or at least we did it like that.

So I assume if it is through WT, it is just classic webmaster spam, where you should click and mine, once you are gone, you are ok. But maybe I am missing something. I have no idea why should be passwords stolen and so on. It is completely different domain. (It is early here, so sorry if I am stupid here.)

Actually those miners are not that bad. I prefer my device to be used to mine some coins instead to see gazilion banners with ads that use my cpu as well.