Back

@atoponce @aral @Codeberg I have had the same problem since at least yesterday evening.

@atoponce @aral @Codeberg and a quick test revealed that it works when I turn off WiFi.

@atoponce @aral @Codeberg what the hell?!
That's from my Pi-Hole. It looks like for whatever reason codeberg.org ended up on my blocklist.

@mforester @aral @Codeberg I am also running a Pi-hole, but it's not showing up in my query lists. Disabling the browser ad blocker still doesn't address it.

But your discovery has prompted me to think I might have something that's catching it, so I'm digging.

@atoponce @aral @Codeberg codeberg.org somehow made it to OSINT's threat list: https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt

@mforester @aral @Codeberg My upstream DNS service provider (not my Pi-hole) is blocking it. Switching DNS servers works. Wild.

Too bad it got caught on the OSINT threat list. I have a feeling this will be a bit of a headache for them.

@mforester @aral @Codeberg It's also identified as a malware domain on Firebog.

https://v.firebog.net/hosts/Prigent-Malware.txt

@atoponce Is someone going around submitting it or is there something about the site that’s triggering these systems?

@mforester @Codeberg

@aral @mforester @Codeberg Looks like it was due to a single instance of someone uploading malware to an issue.

https://codeberg.org/Codeberg/Community/issues/841

@mforester Given that issue is closed, I also opened this: https://codeberg.org/Codeberg/Community/issues/850

@atoponce @Codeberg

@mforester Answering my own question, it’s apparently @davidonzo – hey David, can we please get @Codeberg off of your blocking list at https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt

@atoponce @Codeberg

@aral @mforester @Codeberg @atoponce

Let me check...

@aral @mforester @Codeberg @atoponce

The reason why the domain has been added is this malware report => https://osint.digitalside.it/report/d667c0f13d5f8473209308352cb69a29.html

VT updated link report => https://www.virustotal.com/gui/file/1fd5c566aa8a625297a5910399f4e3700b5e3698f569a446a42a3e9b022640cf/detection

It seems the file has been removed, since a 404 error is returned, but anyway I have to consider the domain compromised.

The retention policy for a compromised domain is 7 days, so tomorrow the domain will disappear.

In case someone can confirm me the domain has been cleaned and remediated I can remove it in minutes.

@aral @mforester @Codeberg @atoponce

Oh, codeberg.org is a collaboration platform and members are able to store software in Git repositories.

Ok, in this case the policy applied is different. Since I can't consider "compromise" a domain allows external user to upload/download data, the domain will be whitelisted.

This means malicious links will be reported in the urls list, but the domain won't be added to the bad domain list.

I'm updating the lists right now.

Thanks for the report!

@davidonzo Thanks so much, David. Appreciate it :)

@mforester @Codeberg @atoponce