sloa-check.com/check.php

[knifephan]

Not sure why, but a few days ago I started seeing my Sophos Endpoint Protection pop up with a warning about how it blocked a malicious website sloa-check.com/check.php. I kind of ignored it at first, but today dug in a little bit and found the requests only occur while I am on Blade Forums. If I have my browser open on 10 other sites I do not see these messages, but while on BF I see them every time I go to a new page. Does BF reference this site for something? Not sure why this is, but I thought I should mention it here in case it should be looked into further.

 

[chevy_racin]

I was getting the same thing. This is from the log. There are other threads that show like this, but not all of them.

20120904 222043 Blocked web request to "www.sloa-check.com/check.php" (linked from "www.bladeforums.com/forums/showthread.php/668159-Lets-see-your-Titanium-frame-lock-pix/page28") for user DOMAIN\USERID. 'Mal/HTMLGen-A' has been found at this website, reference ID 119379790.

Here are a few more:
982336-NYTimes-Police-Fatally-Shoot-Knife-Wielding-Man-in-Times-Square
989301-treasure-huntin-brought-home-a-junkyard-dog!
547127-What-quot-Traditional-Knife-quot-are-ya-totin-today/page771
989312-Progress-report-on-BF-2012-knife!
989288-Four-slipjoints-for-sale-(GEC-two-Case-AG-Russell)-These-must-go!
988604-only-three-tools-in-your-edc/page2

 

[Spark]

I'm testing on this right now. In the meantime I'm closing this thread.