EVO Bikes (Problem with Site : Monero Mining)

[Castolian]

Hi Everyone,

I would just like to enquire with other forum members that perhaps have recently visited www.evobikes.co.za .

Since Last week somewhere I have been getting an warning (1st Attachment) when visiting the Evobikes website, the warning I get is Nortan Safe web browsing alerting me of a script that is run on the Evobikes website when accessing the site and thus prevents me from accessing the site.

When I accept the warning and actually open the scripts of the site that is run you can see that it seems to be running a monero mining script(2nd attachment).

From research online it seems that developers can start building into there sites that visitors to the site assist them in mining virtual currency.

Can someone please test this for me on there PC as well, they can just monitor their CPU usage while accessing Evobikes website.

I have queried this with Evobikes over Facebook and they said they would look into it but I haven't received a response yet. I have also emailed it through to Blyda@evobikes.co.za last week Wednesday but since then haven't received any response.

I would just like to know if it is just me experiencing this problem or if others are also having this script run on their PC. Please note this can only be tested on a PC/Laptop as the problem is not there on the mobile website.

I am also just experiencing this on Evobikes website and not any other website.

Everyone that is willing to check and confirm can just post feedback in this thread.

Edit: If someone has direct contact with the owner input from them can be valuable as well, I only managed to find the email online as a direct contact method to the owner.

Edited September 26, 2021 by Castolian

[bikebloke]

i got it also norton blocks it as a malicious site - blocked recommends i dont visit the site - best evo fixes it 

10 minutes ago, Castolian said:

 

 

[HenryS]

I use Kasperksy and it lets me in, but just blocks the download of the script.

[Matt]

2 hours ago, Castolian said:

Hi Everyone,

I would just like to enquire with other forum members that perhaps have recently visited www.evobikes.co.za .

Since Last week somewhere I have been getting an warning (1st Attachment) when visiting the Evobikes website, the warning I get is Nortan Safe web browsing alerting me of a script that is run on the Evobikes website when accessing the site and thus prevents me from accessing the site.

When I accept the warning and actually open the scripts of the site that is run you can see that it seems to be running a monero mining script(2nd attachment).

From research online it seems that developers can start building into there sites that visitors to the site assist them in mining virtual currency.

Can someone please test this for me on there PC as well, they can just monitor their CPU usage while accessing Evobikes website.

I have queried this with Evobikes over Facebook and they said they would look into it but I haven't received a response yet. I have also emailed it through to Blyda@evobikes.co.za last week Wednesday but since then haven't received any response.

I would just like to know if it is just me experiencing this problem or if others are also having this script run on their PC. Please note this can only be tested on a PC/Laptop as the problem is not there on the mobile website.

I am also just experiencing this on Evobikes website and not any other website.

Everyone that is willing to check and confirm can just post feedback in this thread.

Edit: If someone has direct contact with the owner input from them can be valuable as well, I only managed to find the email online as a direct contact method to the owner.

I’ve just emailed the owner, Naas, to ensure he’s aware of the issue.

[MudLark]

I tend to check their website fairly regularly. Today I can't access it at all – blocked. And it's the only website which I cannot access today. So there is definitely something going on.

Edited September 26, 2021 by MudLark

[splat]

2 hours ago, MudLark said:

I tend to check their website fairly regularly. Today I can't access it at all – blocked. And it's the only website which I cannot access today. So there is definitely something going on.

[Castolian]

5 hours ago, Matt said:

I’ve just emailed the owner, Naas, to ensure he’s aware of the issue.

Thank you Matt, I see the site has been taken offline.

[TCTG]

I received a warning from Avast but it allowed me in. The website appears as https://evobikes.co.za/

Is there any feedback from Naas on this issue?

[EVOBIKES ONLINE STORE]

Hi Hubbers

We are aware the issue when accessing the site from a Laptop or PC. It has been reported to both the developers and Xneelo where we are hosted... They are working on it to ascertain exactly where the issue lies. For the time being rather use a mobile device to access us where possible until we have resolved the issue.

 

[HenryS]

44 minutes ago, Naas said:

Hi Hubbers

We are aware the issue when accessing the site from a Laptop or PC. It has been reported to both the developers and Xneelo where we are hosted... They are working on it to ascertain exactly where the issue lies. For the time being rather use a mobile device to access us where possible until we have resolved the issue.

 

What about all the people that don't have a decent anti-virus and who don't know to go on mobile? The site should stay down for maintenance until it is resolved. Here is a bit of info about the Monero miner. https://blog.malwarebytes.com/detections/trojan-monero/

[Steady Spin]

So your site is infected with a trojan and yet to don't warn visitors? 

How do I know your website won't infect my PC or the PC of any non tech savvy visitor without a third party virus application? 

[Castolian]

14 hours ago, Naas said:

Hi Hubbers

We are aware the issue when accessing the site from a Laptop or PC. It has been reported to both the developers and Xneelo where we are hosted... They are working on it to ascertain exactly where the issue lies. For the time being rather use a mobile device to access us where possible until we have resolved the issue.

 

Thank you for sorting the issue so quickly Naas, I just want to confirm I just accessed the site and Norton Safe Web didn't warn me of anything. I also did look at the scripts when accessing on the home page and couldn't find a reference to mining of any kind.

[Hairy]

13 hours ago, HenryS said:

What about all the people that don't have a decent anti-virus and who don't know to go on mobile? The site should stay down for maintenance until it is resolved. Here is a bit of info about the Monero miner. https://blog.malwarebytes.com/detections/trojan-monero/

 

13 hours ago, Steady Spin said:

So your site is infected with a trojan and yet to don't warn visitors? 

How do I know your website won't infect my PC or the PC of any non tech savvy visitor without a third party virus application? 

If we are browsing on this here world wide web, we should surely be using some sort of antivirus ... heck, even the free ones.

[MORNE]

4 hours ago, Hairy said:

 

If we are browsing on this here world wide web, we should surely be using some sort of antivirus ... heck, even the free ones.

This is sooo 2004 And windows XP though. A properly set up computer wouldn't really need it. Unix based computers LESS so than winblows ones unfortunately for everybody. But even properly up to date windows 10 Defender is enough security to keep you clean these days unless you knowingly visit dodge places and do dodge things on your computer. 
 

my biggest concern about a security breach like this on a online store/ website is all the personal info available to prying eyes…

[betaboy]

???? the life of an online shopper, wipe your feet before you enter.