New Issue loading Lemon Fool website

[chas49]

New problem since yesterday. Malwarebytes is blocking access to the site from my laptop due to 'malware'.

I'm accessing via my phone to post this.

I can exclude the site on MW but am reluctant to do that without a better idea of whether this is truly a false positive....

[SalvorHardin]

MalwareBytes on Windows 10 has been blocking TLF since I tried logging on with Firefox (and Edge and Chrome) this morning, saying that the site is "Compromised"

Chrome on an Android phone running MalwareBytes is fine

[BullDog]

Working fine in Firefox on Android 12 with Malwarebytes app installed.

[stooz]

I have checked the site around various protection sites and it's all approved.
I can only assume someone has posted links to a grown up politics site or sworn.
You will need to log this with your software providers or add Lemonfool to the allow list in your products.

[chas49]

I have checked the site around various protection sites and it's all approved.
I can only assume someone has posted links to a grown up politics site or sworn.
You will need to log this with your software providers or add Lemonfool to the allow list in your products.

Thanks stooz - I've added the site to the exclusions list on my Malwarebytes setup for now. I'll remove the entry in a few days to see if it's changed.

FWIW, the reported threat was either "malware" or "compromised" depending on which browser I was using - so not (I think) an issue with posted links. I assume the protection would only kick in if I followed a bad link on the site.

[chas49]

I have checked the site around various protection sites and it's all approved.
I can only assume someone has posted links to a grown up politics site or sworn.
You will need to log this with your software providers or add Lemonfool to the allow list in your products.

Thanks stooz - I've added the site to the exclusions list on my Malwarebytes setup for now. I'll remove the entry in a few days to see if it's changed.

FWIW, the reported threat was either "malware" or "compromised" depending on which browser I was using - so not (I think) an issue with posted links. I assume the protection would only kick in if I followed a bad link on the site.

Just to add - I had to add CHROME.EXE as allowed to make an outbound connection in order to get onto this site. This doesn' affect any other site I have accessed today. Adding lemonfool.co.uk as an allowed site didn't work.

I'm sure this is some sort of error rather than indicating a problem with the site (IYSWIM), but worth posting here in case others are affected...

[Arborbridge]

I don't know if my issue is related to this thread: maybe not because it only started happening yesterday.

I've been unable to load LMF and receive this notice:


This happens whichever browser I use because it is Malwarebytes which has overnight taken a dislike to this site.

I can only get on here if I quit Malwarebytes, which I don't like doing. This raises two things: is the site in fact safe? and if it is what can I do about it?

The trouble with a workaround is that I ask myhself "why have a dog bark if you don't pay any attention?" There is clearly something which malware finds unwelcome here, but is it dangerous?


Arb.

[SalvorHardin]

I don't know if my issue is related to this thread: maybe not because it only started happening yesterday.

I've been unable to load LMF and receive this notice:


This happens whichever browser I use because it is Malwarebytes which has overnight taken a dislike to this site.

I can only get on here if I quit Malwarebytes, which I don't like doing. This raises two things: is the site in fact safe? and if it is what can I do about it?

The trouble with a workaround is that I ask myhself "why have a dog bark if you don't pay any attention?" There is clearly something which malware finds unwelcome here, but is it dangerous?

I've had the same problem with every browser using Windows 10.

Adding both http://www.lemonfool.co.uk and lemonfool.co.uk to the MalwareBytes Allow List lets me access the website (both addresses seem to be needed, MalwareBytes blocks access if only one address is in the Allow List). I've been running a MalwareBytes full system scan every couple of hours. So far, so good

Norton's safeweb doesn't have any problems with lemonfool, which is reassuring. Here's the link

https://safeweb.norton.com/report/show?url=https://www.lemonfool.co.uk/search.php?search_id=newposts&ulang=en

[Arborbridge]

I don't know if my issue is related to this thread: maybe not because it only started happening yesterday.

I've been unable to load LMF and receive this notice:


This happens whichever browser I use because it is Malwarebytes which has overnight taken a dislike to this site.

I can only get on here if I quit Malwarebytes, which I don't like doing. This raises two things: is the site in fact safe? and if it is what can I do about it?

The trouble with a workaround is that I ask myhself "why have a dog bark if you don't pay any attention?" There is clearly something which malware finds unwelcome here, but is it dangerous?

I've had the same problem with every browser using Windows 10.

Adding both http://www.lemonfool.co.uk and lemonfool.co.uk to the MalwareBytes Allow List lets me access the website (both addresses seem to be needed, MalwareBytes blocks access if only one address is in the Allow List). I've been running a MalwareBytes full system scan every couple of hours. So far, so good

Norton's safeweb doesn't have any problems with lemonfool, which is reassuring. Here's the link

https://safeweb.norton.com/report/show?url=https://www.lemonfool.co.uk/search.php?search_id=newposts&ulang=en

Thanks: some degree of comfort there. I'll try adding the addresses, but an interesting question is: why has this just started happening. After all, I've been running Malwarebytes since LMT started, so one or the other must have changed.

I also have ESET running, which I imagine would protect me quite well. Malware is just an extra.

[chas49]

For further reassurance, Google Safe Browsing says the site is OK as well (https://transparencyreport.google.com/safe-browsing/search?url=www.lemonfool.co.uk

[dave559]

The "SSL received a record that exceeded the maximum permissible length" error looks like the sort of error you often get when your browser tries to make an https request, but the web server responds using plain http instead (because it was unable to negotiate the https connection properly, often because of a misconfiguration on the server somewhere).

The very useful SSL Labs site seems to note that the certs it receives when querying the web server seem to also include a cert for a completely different site, in addition to that for lemonfool itself (see cert #2 on the report page).

I wonder whether perhaps multiple certs (from the certificate issuing authority) have inadvertently ended up in one combined 'bundle' file (rather than being stored separately in the appropriate place for each of the respective websites), and if sometimes the web server is maybe presenting the wrong cert to the browser first (or the browser is somehow trying to use the wrong cert first) so that the browser then fails to negotiate the https connection to lemonfool (for obvious reasons).

https://www.ssllabs.com/ssltest/analyze ... Results=on

(It might also be worth checking whether the hosting company gives the option of using LetsEncrypt certs (most do nowadays), which have the advantages of being automatically self-renewing and also free of charge, as this might be easier than dealing with manually- or only semi-automatically-renewing certs for the website?)

[chas49]

...
The very useful SSL Labs site seems to note that the certs it receives when querying the web server seem to also include a cert for a completely different site, in addition to that for lemonfool itself (see cert #2 on the report page).

The other site mentioned in that report (agapefellowship.co.uk) seems to have the same IP address as lemonfool! Is that correct/posssible/irrelevant to this problem??

Code: Select all

C:\Windows\System32>ping lemonfool.co.uk -n 1

Pinging lemonfool.co.uk [91.146.105.202] with 32 bytes of data:
Reply from 91.146.105.202: bytes=32 time=19ms TTL=52

Ping statistics for 91.146.105.202:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 19ms, Maximum = 19ms, Average = 19ms

C:\Windows\System32>ping agapefellowship.co.uk -n 1

Pinging agapefellowship.co.uk [91.146.105.202] with 32 bytes of data:
Reply from 91.146.105.202: bytes=32 time=18ms TTL=52

Ping statistics for 91.146.105.202:
    Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 18ms, Maximum = 18ms, Average = 18ms

[mc2fool]

...
The very useful SSL Labs site seems to note that the certs it receives when querying the web server seem to also include a cert for a completely different site, in addition to that for lemonfool itself (see cert #2 on the report page).

The other site mentioned in that report (agapefellowship.co.uk) seems to have the same IP address as lemonfool! Is that correct/posssible/irrelevant to this problem??

Lemonfool is on a shared host server. According to https://dnslytics.com/reverse-ip there are 1,333 domains hosted on IP address 91.146.105.202, so it's certainly possible. Whether that domain being on the same host is correct or not is another matter....

[pje16]

...
The very useful SSL Labs site seems to note that the certs it receives when querying the web server seem to also include a cert for a completely different site, in addition to that for lemonfool itself (see cert #2 on the report page).

The other site mentioned in that report (agapefellowship.co.uk) seems to have the same IP address as lemonfool! Is that correct/posssible/irrelevant to this problem??

Lemonfool is on a shared host server. According to https://dnslytics.com/reverse-ip there are 1,333 domains hosted on IP address 91.146.105.202, so it's certainly possible. Whether that domain being on the same host is correct or not is another matter....

Shared servers are commonplace
Does anyone have a problem loading Google (that is shared)

[mc2fool]

...
The very useful SSL Labs site seems to note that the certs it receives when querying the web server seem to also include a cert for a completely different site, in addition to that for lemonfool itself (see cert #2 on the report page).

The other site mentioned in that report (agapefellowship.co.uk) seems to have the same IP address as lemonfool! Is that correct/posssible/irrelevant to this problem??

Lemonfool is on a shared host server. According to https://dnslytics.com/reverse-ip there are 1,333 domains hosted on IP address 91.146.105.202, so it's certainly possible. Whether that domain being on the same host is correct or not is another matter....

Shared servers are commonplace
Does anyone have a problem loading Google (that is shared)

No it isn't. Google, and any/all major sites, have dedicated servers with dedicated IPs. Shared hosts are, indeed, very common but they are used by smaller outfits that can't afford a server(s) just for themselves.

[pje16]

I thought it was but that link you posted shows otherwise

[XFool]

I have checked the site around various protection sites and it's all approved.
I can only assume someone has posted links to a grown up politics site or sworn.

FWIW, the reported threat was either "malware" or "compromised" depending on which browser I was using - so not (I think) an issue with posted links. I assume the protection would only kick in if I followed a bad link on the site.

I wonder...

Could the Google Ad server be serving up links to dodgy sites again? It's happened before:

viewtopic.php?p=422058#p422058

viewtopic.php?p=214022#p214022

[88V8]

I don't know if my issue is related to this thread: maybe not because it only started happening yesterday.
I've been unable to load LMF and receive this notice:...

I have the same problem as Arb, started two days ago, this is the first time I've been able to get on, using Firefox or Chrome or IE.
Was/is being blocked by the browser and by Malwarebytes.
I just added to the MWB Allow list, perhaps that's why I'm here.

Something has changed at the domain.

V8

[Arborbridge]

I'm a simple fellow: I just want to log in to LMF, safely. I have some experience but almost no knowledge and although I follow some of the posts about what might be wrong, how is it going to be resolved?
Like driving a car, I do not want to get involved in how it works, I just want it to "go".

As V8 says, something has changed. From the discussion, it seems possible that some other site - possibly an unpleasant of dangerous one - might be sharing the same IP code, so putting our site on a safe list might be the wrong thing to do anyway.

I deduce that all the posters who use LMF now are probably not running anti-malware program as sensitive as Malwarebytes, or have taken the risk of making this address "safe".

Unless the cause can be isolated, it is risk.

PS Probably totally unconnected, but I frequently (like just now) have a notice come up when posting saying that this site could not be found - try again?
Arb.

[servodude]

I deduce that all the posters who use LMF now are probably not running anti-malware program as sensitive as Malwarebytes, or have taken the risk of making this address "safe".

Or Malwarebytes is a bit twitchy among the plethora of possible guarding software users might be using?

I do get occasional "not found" messages but I've been inclined to put them down to issues/timeouts with DNS resolution
- I don't expect the site admins here to be worried about maintaining their place in a resolution search or even their IPv4 address; the site is hosted by a third party and we all use it cos we know the url.. we do that without putting across any details that would compromise us (n.b. IF your bank details ARE the same as your fool login.... PLEASE RETHINK THIS!!)

It's not yet time to panic
- unless Snorvey planted a bomb!