Prompt for username/password leading to another site?

[Kyle Worden]

I've never seen this before, found it while searching some older threads. Can anybody else confirm that this happens for them?

 

 

[Shpaget]

Looks like you've got yourself some malware.

[Red Iron Crown]

53 minutes ago, Shpaget said:

Looks like you've got yourself some malware.

This. 

[Kyle Worden]

2 hours ago, Shpaget said:

Looks like you've got yourself some malware.

Hmmm, sure hope not, the only downloads I've made since my last scan were KSP mods and all the links were grabbed from these forums. Running another scan to be safe.

[Kyle Worden]

1 hour ago, Red Iron Crown said:

This. 

Why would malware only affect one forum thread? As far as I can tell, it only pops up here

 

[TheRagingIrishman]

ksp.schnobs .de is not a website associated with any official Squad based site so you might want to install an antivirus (also, you can get malware without actively downloading stuff, it can be hidden inside websites or emails)

[Kyle Worden]

35 minutes ago, TheRagingIrishman said:

ksp.schnobs .de is not a website associated with any official Squad based site so you might want to install an antivirus (also, you can get malware without actively downloading stuff, it can be hidden inside websites or emails)

My antivirus scans all my downloads but I'm running a full scan to be safe, just seems odd that its a ksp related site, and only pops up on one forum thread that i've found so far.

[Red Iron Crown]

47 minutes ago, TheRagingIrishman said:

ksp.schnobs .de

I happen to know who runs that site, long time KSPer and all around good person.

[DaveTheFish]

If you go to that site, it also asks for credentials, along with the message, "Sprich Freund und tritt ein." According to Google Translate, Speak friend and enter. Maybe something to do with the Doors of Durin then. Anyone know what the username/password might be? I'm guessing the password is "mellon."

[Gordon Fecyk]

The password prompt is coming from a link to ksp.schnobs.de/eve/The_Eve_Rocks_Challenge_badge.png and otherwise doesn't appear to be sinister.

Name	Protocol	Method	Result	Content type	Received	Time	Initiator
http://ksp.schnobs.de/eve/The_Eve_Rocks_Challenge_badge.png	HTTP	GET	401	text/html	461 B	73.24 s	image

Sounds like something simple, such as someone's old image server having been reconfigured. The first instance on that thread is on a signature, on a post from @Perry Apsis. Perry, if you read, please check your image link in your signature and, if needed, point it to another host for that badge. Anyone else using the Eve Rocks badge should check their signatures.

Side note: I've been doing IT for twenty-one years. I figured this one out using the debug tools in my browser; most browsers have them, even MS Edge.

Edited June 30, 2017 by Gordon Fecyk
Ugh, spelling

[Red Iron Crown]

I spoke with the person running that server, the webserver portion has been disabled for now so we shouldn't see these login prompts any more.

[Stone Blue]

22 hours ago, Red Iron Crown said:

I spoke with the person running that server, the webserver portion has been disabled for now so we shouldn't see these login prompts any more.

I JUST now had this start happenning... I've been spending a LOT of time scouring mod release threads for updates over the past month, never seen this, then it just now started... I've been going thru old threads in the Add-Ons Releases forum... (on page 18 now )

If it helps in troubleshooting, this is the last "good" thread I opened (along with downloading files from its Github repo):
 

Then, I clicked on THIS thread, and thats when it started happening :
 

EDIT: So I also decided maybe I'd look at the page source for that thread, and yup, it looks like user @Vaporo also links to that Eve Rocks Challenge badge on the schnobs .de site... ???

Edited July 2, 2017 by Stone Blue

[Stone Blue]

On 6/29/2017 at 7:50 PM, shadoxfilms said:

My antivirus scans all my downloads but I'm running a full scan to be safe, just seems odd that its a ksp related site, and only pops up on one forum thread that i've found so far.

What thread?

[Red Iron Crown]

Thanks for the report, Stone Blue. I'll message the user about it again.

[Stone Blue]

44 minutes ago, Red Iron Crown said:

Thanks for the report, Stone Blue. I'll message the user about it again.

Thanx

[Red Iron Crown]

Should be all squared away now, please report this issue if it recurs.