KAPPA.LOL via Customs Forge is trying to infect my PC with Malware. Please check

[AtrumAnimus]

Greetings;

I am a huge fan of CusstomsForge and check your site daily multiple times a day and have even commissioned custom CDLC from Gov't Mule.  I love it and consider it essential to my playing and happiness. I am also a Sr. Security Architect.  Starting on Feb 17, 2025 I started blocking malware attempts via your web page that are being sourced from kappa.lol - IP address 172.67.213.73 - I get the breach attempt every-time I refresh the search engine page.  I just assumed you would be on top and take care of it.  So I just informing you in case you had not noticed yet.  It could be a false positive, but I error on the side of caution and block first. 

Virus Total has 1 hit on the site as malicious: https://www.virustotal.com/gui/url/768124885d0de5d3c67f0c9fbf93d203db2cc0ab56bf0abd147cd0ba9803ade4

https://ignition4.customsforge.com/

I really appreciate all that you all do for the Rocksmith community - Keep up the great work.  Hope this was helpful.

[AtrumAnimus]

I just spoke with Fortigate support and they are reclassifying the site KAPPA.LOL as malicious and Malwarebytes now has it listed as RiskWare.  It is attempting to install software without permission.

Edited February 21 by AtrumAnimus
forgot attachment

[WaynePlay]

Hey

I can confirm too, that Malwarebytes keep saying "Kappa.lol" but with A different IP adresses.

 

[Phantatsy]

My best guess is it being ad related. However, I have notified the rest of the team and we will look into it.

[Unleashed2k]

We have switched ad providers, please confirm if this is still happening. Unblocking the ads would be appreciated. Thanks

 

On 2/22/2025 at 3:15 PM, WaynePlay said:

Hey

I can confirm too, that Malwarebytes keep saying "Kappa.lol" but with A different IP adresses.

 

 

On 2/21/2025 at 10:01 AM, AtrumAnimus said:

Greetings;

I am a huge fan of CusstomsForge and check your site daily multiple times a day and have even commissioned custom CDLC from Gov't Mule.  I love it and consider it essential to my playing and happiness. I am also a Sr. Security Architect.  Starting on Feb 17, 2025 I started blocking malware attempts via your web page that are being sourced from kappa.lol - IP address 172.67.213.73 - I get the breach attempt every-time I refresh the search engine page.  I just assumed you would be on top and take care of it.  So I just informing you in case you had not noticed yet.  It could be a false positive, but I error on the side of caution and block first. 

Virus Total has 1 hit on the site as malicious: https://www.virustotal.com/gui/url/768124885d0de5d3c67f0c9fbf93d203db2cc0ab56bf0abd147cd0ba9803ade4

https://ignition4.customsforge.com/

I really appreciate all that you all do for the Rocksmith community - Keep up the great work.  Hope this was helpful.

 

[newch]

Just starting today for me, but Malwarebytes is blocking kappa.lol every time I change pages on the main search page.