Newegg appears to be infected with some kind of social engineering hack

[remixedcat]

when did this happen actually? I had to enter my CC# for the premier thing and I hope to the cat gods that my number didn't get taken... it takes me freakin 2-3 weeks to get a new CC and there's other crap with my bank as well,...

 

[R-T-B]

when did this happen actually? I had to enter my CC# for the premier thing and I hope to the cat gods that my number didn't get taken... it takes me freakin 2-3 weeks to get a new CC and there's other crap with my bank as well,...

I suspect it was just an advertising partner misbehaving and not a breach.

Regardless, seemed to happen roughly 6PM PST, and ended about 9PM PST for me.

 

[remixedcat]

Here's a handy report on the IP address this attack is originating from http://urlquery.net/report.php?id=1447553569796
Please see there lots of IPs to block in your firewalls to further secure yourselves from other malware/attacks as well. I blocked in my hardware and software firewalls and hostsfiles as well. I suggest y'all do so too

 

[aasim1111]

Now is it safe. I have been wanting to buy a gpu ND now finally it's on sale.

 

[R-T-B]

Now is it safe. I have been wanting to buy a gpu ND now finally it's on sale.

I haven't got an official reply from newegg yet but it does seem fixed.

 

[remixedcat]

Please, also everyone report the host reported in the following URL (Note Please do not report to/of netcraft but the site contained within the report) http://toolbar.netcraft.com/site_report?url=http://www.codehost.ml as well and tell them their hosting client is placed malware on the server. The more people report this activity to the webhosts the less infections we need to worry about... I know it's like cutting heads off a hydra, however at least it'll provide some breaks. However, in the meantime please block those IPs and such from the report I linked above in your firewalls and such.

CentriLogic Inc. is the ASN/NETBLOCK owner and alert THEM first. Then it will go down the food chain and that "PKHost" company's shit will get brought down BC there's a lot of malware coming from thier clients.

 

[Jetster]

@Jetster are you in portland w cumcast?

Close enough

 

[Toothless]

I forget when you live maybe you have been redirected by a virus on a server somewhere

I live maybe 2 hours from him and I don't get anything like this from the egg.

 

[remixedcat]

Posted this on newegg's FB page:

For all that want to contact the owners of the IP address where the attacks originated from please contact support@centrilogic.com and be very nice and tell them the attacks came from codehost.ml and they are hosted with PKHost which resides on the network of Centrilogic. If we get rid of the source of the attacks we can save other webmasters/admins as well as newegg. source 1 http://toolbar.netcraft.com/site_report?url=http://www.codehost.ml source 2: http://urlquery.net/report.php?id=1447553569796 also source2 has IP addresses you can block in your firewalls till centrilogic or the other layers of the food chain can take action. Please be safe eggers!

 

[remixedcat]

Blogged for its and shiggles: http://remixedcat.blogspot.com/2015/11/neweggcom-compromised.html

 

[jboydgolfer]

didnt this all start after they added the "we stand together" insert on they're page? the "je suis paris" stuff regarding the terrorist attacks?

 

[remixedcat]

Reply from the host they at least acknowledged it

 

[Rhyseh]

I'd agree in saying its more likely an affiliate ad or plugin server, I doubt Newegg itself is compromised, else we would not likely be seeing the regional differences. Chances are high someone in a NOC is sending nasty emails to someone by now....

 

[R-T-B]

I'd agree in saying its more likely an affiliate ad or plugin server, I doubt Newegg itself is compromised, else we would not likely be seeing the regional differences. Chances are high someone in a NOC is sending nasty emails to someone by now....

I'm nearly 100% confident it is now. People have traced it to the ip range and newegg.com itself does not seem related.

To be clear, I really doubt Newegg itself was compromised.

 

[remixedcat]

Like I said it wasn't newegg's server, however it's something that still needs to be stopped and newegg needs to obliterate all refs to it from thier site's code. Stopping the code from running on multiple sites that ref this code would be super effective! I hope that not just me reported it to the damn host or I'm gonna be pissed. Please everyone report it, hosts will listen more to multiple reports! we need to do this!

 

[Mercennarius]

I was getting the exact same prompt on Anandtech.com's forum last week...

http://forums.anandtech.com/showthread.php?t=2453033

 

[remixedcat]

and that Ip is going to softlayer in TX...

]also more IPs to block in my firewall

 

[remixedcat]

softlayer now contacted...

and an interesting tid-bit about softlayer

 

[Rhyseh]

Softlayer, AWS, Azure.... You get the same issue from all of them. AWS seem to be pretty responsive with this kind of stuff though.

 

[rtwjunkie]

Don't know if related, but last night for about an hour Newegg ONLY showed Marketplace items, and any search by me for brand names MSI and EVGA brought back zero results. Lol.

 

[xorbe]

I don't think Newegg was the only one with problem today.

On a fresh+updated install of Win7 on an undoubtedly clean machine (pw protected, only I use it), I went to FB was was redirected to a "notes" page on FB that was some sort of MLM scheme. Creepy as hell. Either dad's home router is compromised (seems unlikely, it's pretty new), or something tweaked on the FB server.

 

[remixedcat]

well I have all the IPs and HOSTNAMES from both site reports on my firewalls on ALL VLANs. I suggest you do this as well.

 

[Jetster]

Cool a gift.

 

[R-T-B]

Wait, you got a gift? Nice!

 

[Jetster]

Its a Newegg Bennie. I already have one. If you want it Ill send it to you. after all you started this