I just keep finding interesting stuff…
I’ve noticed how virustotal gives some blacklists in couple of webpages created with mediawiki, for instance finalfantasy.wikia.com and starcraft.wikia.com. Both blacklists seem to be from Quttera showcasing that some blacklisted external links are located in the wikis, in both cases seemingly “-http://web.archive.org”
Yep, and why this has been blacklisted then?: -http://archive.org/web/
seems puzzling to me.
And this provider for re-directing here? https://www.kpn.com/prive/tv-internet-bellen/informatie/internet.htm
coming from -home.planet.nl (which provider site service has indeed been discontinued years and years ago).
Discontinuation of resources that helped to build the info lies at the basis of the blacklisting, I assume.
I can establish this because I live in the country where one of the blacklisted sources, the major national telecom provider of the Netherlands KPN is situated or rather was as home planet, as I am a Dutch subject myself, living near Rotterdam Holland.
See: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fstarcraft.wikia.com
Landing at google analytics → http://slot1.images3.wikia.nocookie.net/ from FASTLY - Fastly,US in Switzerland.
But wiki reports come from commonName=*.wikia-services.com/organizationName=Wikia, Inc./stateOrProvinceName=California/countryName=US so they are responsible for maintaining and contents to be reliable!
With Scanning -http://slot1.images3.wikia.nocookie.net/ …I get a Status: fail
Site is insecure: -starcraft.wikia.com
Alerts (1)
Insecure login (1)
Password will be transmited in clear to -http://starcraft.wikia.com/wiki/Special:UserLogin
Infos (1)
Encryption (HTTPS) (1)
Communication is NOT encrypted → 20% of the trackers on this site could be protecting you from NSA snooping. Tell wikia.com to fix it. 20 instances may be id-tracking you on that site (no privacy)
-starcraft.wikia.com
-community.wikia.com
-comScore
-Google
-slot1.images1.wikia.nocookie.net
-slot1.images4.wikia.nocookie.net
-slot1.images3.wikia.nocookie.net
-slot1.images.wikia.nocookie.net
-slot1.images2.wikia.nocookie.net slot1.images2.wikia.nocookie.net
-local.adguard.com (that is my adblocvker injected script, the ids are later anonymized)
-img3.wikia.nocookie.net
-vignette2.wikia.nocookie.net
-a.wikia-beacon.com
-vignette3.wikia.nocookie.net
-vignette4.wikia.nocookie.net
-vignette1.wikia.nocookie.net
-Optimizely
-Quantcast
-img1.wikia.nocookie.net
-images3.wikia.nocookie.net
I should also attach a tracking the trackers report, but I think part of the overall pricture has become clear to you now
as to what an enormous extend all this info comes controled and scrutinized by parties other than the end-user.
Both in the States as in Switzerland for that wiki matter.
So all isn’t always that what it looks at first glance. ;D
Pernaman, this is good info to always have at the back of your head when analyzing certain official websites.
polonus (volunteer website security analyst and website error-hunter)
Sorry polonus, but you got me again rather lost there. :-[ Were there really some insecurity on these webpages or was it something else? :-\
Hi pernaman,
No, no malware whatoever as far as I could establish. Only and exclusively some misinterpreted older info blacklisted.
See:
Because a service or a site address is no longer aroudn, does not mean it has been taken down for being malicious.
Planet (home.planet) was the internet service site for KPN, Dutch telecom users of such an account.
The account service was discontinued and terminated. I think the name now is KPN.
So all issues online should be checked for what they are and not wildly interpreted.
That’s all, a lkot ado about nothing on an old archived wiki site. Confirmed here: https://urlquery.net/report.php?id=1447778509410
polonus
Virustotal still seems to give blakclist for domains like finalfantasy.wikia.com Quttera, but after running a scan from Quttera itself it shows clean. Possibly Virustotal is a bit slow to update some of their listings? ???