'Your Computer Or Network (Xx.Xx.Xx.Xxx) Is Showing Signs Of Infected Behavior. '

[bangkokcitylimits]

This link: http://thailand-business-news (url cut here) .com/investment/27607-thailand-china-high-speed-train-project-to-start-in-2011

shared via http://bit.ly/ihGfOm

redirects to an unknown website (screenshot) that 'warns me for infected behaviour' of my system, but I don't believe it and wonder where they get this information from ? After all, it could also be the website itself that has a problem.

I know Bit.ly sometimes has the strange behavior to suddenly mark a normal website as being suspicious, but this warning page does not come from Bit.ly.

Perhaps anyone who got the same and what do you think ?

[Crossy]

This is a trigger from Cloudflare security http://www.cloudflare.com/ not sure yet if it's actually a scam or you really are showing signs of infection.

Whilst looking in to it I myself got a warning of infected behaviour and I'm 99.99% certain I've got nothing.

Anyone else?

[shriah]

This is just a problem with Cloudflare and http://thailand-business-news nothing wrong with your computer. I think Cloudflare cannot resolve the DNS for http://thailand-business-news and it is creating problem.

[CharlieH]

This is just a problem with Cloudflare and http://thailand-business-news nothing wrong with your computer. I think Cloudflare cannot resolve the DNS for http://thailand-business-news and it is creating problem.

Dont know much about computers, but just clicked through EVERY link in this thread withut problem, connected everywhere immediately. Sorry but dont know if that helps or not, but everything worked for me without redirection, warning, or issue.

[astral]

I would be very suspicious of any site that redirects you in that way.

My guess is that they have been hacked and the redirection will

take you to a site that wants to relieve you of money to solve the "problem".

[cloudflaredamon]

Hi bangkokcitylimits,

I actually work for CloudFlare (i've also lived in Thailand).

The site you tried to access is using CloudFlare to protect and speed up their website & that challenge page appears if a visitor is potentially threatening (botnet zombie, etc.). I would still recommend running a scan on your computer to make sure you don't have any viruses (more information about how we identify potential threats). You can also simply pass the captcha on that page to enter the site in question.

Note: You can also look your IP up here to see why you're being presented with a challenge page.

[lopburi3]

So are you saying that because there was an increase in activity from xxx.xxx.xxx.xxx because of a local article targeted to that area your solution is shielding your client from a non attack and telling visitors there machines are likely infected?

My response would be to never return.

[Nawak]

I opened the URL in Safari Mac OSX and was not redirected to the warning page.

[halfhead]

I got the same warning,as it happens the machine Im on had infections,I removed them and tried again and all ok(no warnings)

[lopburi3]

In that case it seems to have worked well for you. The strange thing is both you and OP share the same provider and often use the same IP address. Did you just access the site or earlier than the OP?

[bangkokcitylimits]

My system runs:

24/7 Avast Antivirus

24/7 Malwarebytes

27/7 IObit Security 360

24/7 RuBotted Botnet checker

24/7 IObit SystemCare

Daily maintenance scans before closing the system or during the day:

CCleaner

Registry Cleaner

Privacy Sweeper

Disc Cleaner

File Shredder

Defragmenting

Internet Booster

Smart Ram optimizer

And a series of scanners available for specific problems, like TDSS Killer etc.

So I wonder why a remote tool (still) can find something within a millisecond, I don't take that so easy. There are too many fake products, warning sites etc. regarding scanning, warning, repairing, optimizing etc. and there are always a percentage of people who believe anything and spend money on tools with no function.

If Cloudflare is able to see that my system is 'showing signs of infected behavior' it should be able to also tell me instantly what it the 'sees' but instead I get a misty page with Google ads. No thanks.

Website owners should be more clever and are loosing a lot of visitors this way.

edit:

I just entered the Thai Business site via my VPN account using various IP locations around the world, could access the site no problem.

Perhaps Cloudflare should contact CAT Telecom CDMA because they seem to be infected if you ask me.

Edited November 30, 2010 by bangkokcitylimits

[halfhead]

In that case it seems to have worked well for you. The strange thing is both you and OP share the same provider and often use the same IP address. Did you just access the site or earlier than the OP?

I went to this site after him,seems like an ISP thing alright

[halfhead]

This site takes ages to load,does not seem to work by using a proxy

maybe that software is a little too sensitive

[cloudflaredamon]

My system runs:

24/7 Avast Antivirus

24/7 Malwarebytes

27/7 IObit Security 360

24/7 RuBotted Botnet checker

24/7 IObit SystemCare

Daily maintenance scans before closing the system or during the day:

CCleaner

Registry Cleaner

Privacy Sweeper

Disc Cleaner

File Shredder

Defragmenting

Internet Booster

Smart Ram optimizer

And a series of scanners available for specific problems, like TDSS Killer etc.

So I wonder why a remote tool (still) can find something within a millisecond, I don't take that so easy. There are too many fake products, warning sites etc. regarding scanning, warning, repairing, optimizing etc. and there are always a percentage of people who believe anything and spend money on tools with no function.

If Cloudflare is able to see that my system is 'showing signs of infected behavior' it should be able to also tell me instantly what it the 'sees' but instead I get a misty page with Google ads. No thanks.

Website owners should be more clever and are loosing a lot of visitors this way.

edit:

I just entered the Thai Business site via my VPN account using various IP locations around the world, could access the site no problem.

Perhaps Cloudflare should contact CAT Telecom CDMA because they seem to be infected if you ask me.

Hey bangkokcitylimits,

Thanks for the feedback (we're currently in the process of redesigning the challenge pages to make them less scary). We're also looking at something for dealing with NATS, etc. If it helps any, we also expire IPs after no threatening activity is displayed after some period of time (you can look IP data up here).

There will always be false/positives with our service that can be help be corrected by admins whitelisting IPs from good visitors. The one unfortunate thing is that there's a lot of spam and botnet activity in Thailand ...so there's probably more of a risk of false/positives.

[PoorSucker]

Took forever to load.

No false positive.

Wasn't cloudflare supposed to speed up the website?