Php.net detected as a malware host by Google Safe Browsing

Re:Php.net detected as a malware host by Google Safe Browsing by babawere on Thursday October 24, 2013 @06:38AM (#6604429)

Its was definitely hacked .. the log shows that the size of userprefs.js has definitely changed multiple times in the past 25 hrs : http://lerdorf.com/static.log.gz

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by junto on Thursday October 24, 2013 @06:52AM (#6604465)

The site that is linked to in the obfuscated code is http://lnkhere.reviewhdtv.co.uk/stat.htm and it is that site which Google has marked as unsafe. Php.net has received the malware warning as a result.

http://safebrowsing.clients.google.com/safebrowsing/diagnost...

Notably the whois on that domain includes the registrants full name and address. Nominet allows personal registrants an opt-out on the full details in whois, so you would be unlikely to try and hack PHP.net and forget to use a privacy service on a domain name that isn't quite so traceable..

The domain record for that site show:

  Domain name:
      reviewhdtv.co.uk
 
  Registrant:
      Oli Bachini
 
  Registrant type:
      UK Individual
 
  Registrant's address:
      Rainbow Cottage
      West Perry
      Huntingdon
      Cambs
      PE28 0BX
      United Kingdom
 
  Registrar:
      Webfusion Ltd t/a 123-reg [Tag = 123-REG]
      URL: http://www.123-reg.co.uk
 
  Relevant dates:
      Registered on: 13-Oct-2010
      Expiry date:  13-Oct-2014
      Last updated:  06-Oct-2012
 
  Registration status:
      Registered until expiry date.
 
  Name servers:
      ns.123-reg.co.uk
      ns2.123-reg.co.uk
 
  WHOIS lookup made at 11:44:39 24-Oct-2013

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by bruceboughton on Thursday October 24, 2013 @08:55AM (#6604948)

While this is publicly available information, I'm not sure what purpose it serves to post it here as they are quite possibly an innocent bystander.

You are just making them a target for malicious people who would otherwise be too lazy to find that information.

It is pretty bad form to post people's personal addresses on a forum such as this.

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by phogg on Friday October 25, 2013 @06:55AM (#6610800)

Whois data is public in any case, so there's no harm to re-posting it.

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by bruceboughton on Friday October 25, 2013 @09:37AM (#6611476)

>> While this is publicly available information

>> You are just making them a target for malicious people who would otherwise be too lazy to find that information.

I already addressed that.

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by OGC on Thursday October 24, 2013 @07:15AM (#6604543)

That site probably was hacked, too.

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by dingdingdang on Thursday October 24, 2013 @09:25AM (#6605093)

And this comment probably is too; who can we trust - am I the only one seeing this comment? Will it disappear after reload? WOhaa.

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by rurban on Thursday October 24, 2013 @11:03AM (#6605653)

Whow

  $ zcat ~/Downloads/static.log.gz |
  perl -lne'if (m/ 200 (\d+)/) { print $1 }'|sort |uniq -c
    390 0
    523 10881
    639 12479
  16276 1279
 178111 2602
      1 4071
     14 4072
     63 4801
    112 4812
   9431 5097
  27654 5821
    110 5911
   1348 6008
    162 7884
    256 8278
    568 9035
   1103 9634

That's a lot of changes

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by smsm42 on Thursday October 24, 2013 @01:58PM (#6606770)

You seem to be counting all the files, not just this one file.

Update: no, you're correct, this log apparently only has one file.

[ Parent | on HN ]