A lot of people are seeing this issue if they are running a browser with AdBlock installed on it. One of the most popular filters for AdBlock is "Fanboy's List." AdBlock periodically updates the lists on it's own. This particular list update goes through Cloudflare. That's why it seems to pop up randomly when browsing. It's not the sites that are being blocked. It's the browser itself.
There are many filter lists available for AdBlock. Choose a different one and it will solve this problem. (If that's where your problem is coming from anyway.)
It's alot more complicated than simply turning off adblock, turning of adblock ( Fanboy list ) may stop some of the warnings but not all - read below for the latest
Posted by Malwarebytes root admin
tedivm
Hey guys, I just wanted to step in here for a second and kind of summarize things so far, as well as give you guys an idea of what's going on behind the scenes.
This is a very, very tough situation. On the one hand we have a a group of websites, hosted through CloudFlare, that are actively pushing drive by exploits. What this means is that people who go to those sites are getting exploited and potentially have no idea of knowing this. On the other hand we have a lot of innocent websites which are doing nothing wrong, but are caught in the cross fire.
This is a situation we have some experience with. We at Malwarebytes use Edgecast for content delivery- a service somewhat similar to CloudFlare, in that they distribute our main page to various nodes all over the world for easier delivery. We also use a multitude of other CDNs for delving updates- and sometimes they get blocked and we're caught in the crossfire as well. Its a sucky situation.
Of course, we're also on the other side of this- we do the blocking when we need to. What most people don't see is the huge amount of effort we do to keep people from being blocked. The vast majority of people pushing malware out do so without knowing or intending to- something as simple as an outdated wordpress install can be the vector which an innocent site gets used to push malware. We also know that a lot of people use CDN's or shared hosts, so blocking one site could mean blocking far more.
We work with a lot of CDN's and webhosts to keep them off blacklists- and we always email the abuse teams before adding them. Nine times our of ten the malware gets removed within hours or our email, and no blacklisting is required. Unfortunately there are cases were simply removing the malware isn't enough- not all websites are innocent. Some people are actually pushing the malware on purpose, so when the third party host (such as the CDN or shared web host) remove the offending URL, the people running the site simply change the URL being used. In this case we try to work with the providers to fix the issue, but if it is unable to happen we blacklist the URL.
Now, I want to be very clear about something- we do not blacklist information. We are not censors- knowing how to make malware is not in itself a bad thing. If it wasn't for people learning these skills, we wouldn't have researchers protecting our users. We will not block someone just for posting information. We won't even block people for hosting malware if they're doing it safely. The thing we block is people hosting active exploits or active malware that will infect users without their knowledge.
Unfortunately this CloudFlare situation has escalated further than I think anyone intended. We have a lot of respect for CloudFlare- I met Matt at DefCon last year, where he gave a fantastic talk about dealing with the Slowloris attack, as well as the challenges of hosting an activist group like Lulsec. I feel a lot of what's going on right now is more miscommunication than anything, but from my understanding Marcin and Matt are now in direct contact and this should be resolved soon.
I know this is not an ideal situation, but I assure you everyone involved is doing what they feel is right to protect their users and there is no malicious intent here. We're working as quickly as we can to get this current issue resolved, and I'm hoping this will be a learning experience for future issues. We'll have an update as with more information soon.
Robert Hafner
Vice President of Information Technologies
