Solved High Risk website blocked? "Count.IM"

[Kiki]

No, it's the AV. I'd say paneubert doesn't have an ad blocker activated in his browser or he wouldn't see the block.

Gotcha

 

[paneubert]

No, it's the AV. I'd say paneubert doesn't have an ad blocker activated in his browser or he wouldn't see the block.

True. But my research a few months ago did point towards the Count.IM site being served to us via the ad platform that Backyard Chickens uses. Since it popped me a warning on every single page of Backyard Chickens. Any page on this site that had a spot for an ad (which is all of them) seemed an opportunity for that Count.IM to be served (and warned about).

 

[paneubert]

Thanks but I run Macs.
I was just curious I had never heard of it and was wondering if it was "safe."

Normally someone online offering to remote into your machine is suspicious. So your wondering was from a wise perspective. Haha. The "offering to remote in" is a common scam where someone from overseas cold calls you and claims to be from Microsoft. If you let them in, they wreak havoc....

 

[Kiki]

Normally someone online offering to remote into your machine is suspicious. So your wondering was from a wise perspective. Haha. The "offering to remote in" is a common scam where someone from overseas cold calls you and claims to be from Microsoft. If you let them in, they wreak havoc....

This is what was coming to mind.

 

[StarChicken]

Normally someone online offering to remote into your machine is suspicious. So your wondering was from a wise perspective. Haha. The "offering to remote in" is a common scam where someone from overseas cold calls you and claims to be from Microsoft. If you let them in, they wreak havoc....

Nope, I'm a pretty smart chicken. I've known my guru for several years and trust her implicitly. She's pulled my bacon out of the fire several times, since my area of expertise is more in the line of building and repairing computers and hardware, while hers is security plus a lot more. She's been an invaluable help through this mess, and I think we may have a real handle on it now.

BTW, it's a good thing you did that "whois" on count.im, since the new EU laws have redacted all pertinent information about the site.

 

[StarChicken]

@Nifty-Chicken

I understand the need for ads, but in this instance, I must block ads because of this problem. If the problem was gone, I wouldn't have to block them. My TenForums security expert cleaned my system and put uBlock Origin ad blocker on Firefox. I cannot eliminate the ad blocker until this situation is resolved. Below is what uBlock Origin ad blocker has found:

Note that count.im is listed.

Also note that everything pertinent about count.im has been redacted as follows:

The Security Expert said, "Someone pulled a WHOIS on count.im earlier in the year, before the stupid GDPR went into effect in Europe........you see all the data is now redacted because of that stupid law. But, whoever pulled the info earlier, saw it was registered to someone in Russia.

"So I believe it's in their best interest to block those 2 servers." The two servers mentioned are those marked with red arrows.

I believe paneubert got a good "whois" on count.im and posted it at the beginning of his thread.

@paneubert Maybe you can list what you found here?

 

[Nifty-Chicken]

Thanks for all the great details and screenshots!

I've forwarded this (and the other threads) to our guy who manages all our advertising and ad-networks to see if he can track this down and get more info.

 

[cjoffutt]

We run Sophos at work. It picks it up CONSTANTLY as well. Annoying, but something I just get used to as the popup is on a secondary monitor so isn't as intrusive.

 

[Nifty-Chicken]

FYI: we've found and blocked this!

(I also merged these two threads to have everything in one place)

If you see / experience any more warnings from "count.im", please post here!

 

[Kiki]

FYI: we've found and blocked this!

(I also merged these two threads to have everything in one place)

If you see / experience any more warnings from "count.im", please post here!