Suspicious web page

[HokieHi 2]

My security software is throwing a "Suspicious web page" message.

====

Feature:

Online Threat Prevention

The page http://ia600209.us.archive.org/21/items/mbid-bc8d47aa-7892-44a0-85b2-6e6ce974f40c/index.json has been detected with suspicious activity. It is not recommended to continue browsing this website. Accessed by: embyserver.exe

====

 

Server is up to date and has been running for years (and years) without issues.

 

Any ideas why this is popping up?

[Lessaj 467]

Would probably need to see the server log but based on the contents of the json are you using the Cover Art plugin?

[HokieHi 2]

I don't believe I am using that plugin.

 

2024-08-02 00:00:00.387 Info App: Plugins:

Backup & Restore 1.6.6.0

Bluray Folder Support 1.0.2.0

Cinema Intros 1.0.47.0

DLNA 1.4.3.0

Dvd Folder Support 1.0.0.0

Emby Guide Data 1.0.13.0

Fanart.tv 1.0.16.0

Genre Cleaner 1.0.25.0

M3U TV Tuner 1.0.31.0

MovieDb 1.7.7.0

MusicBrainz 1.0.24.0

Nfo Metadata 1.0.80.0

OMDb 1.0.21.0

Open Subtitles 1.0.59.0

Port Mapper 1.2.4.0

Sonos Controller 1.0.22.0

Studio Images 1.0.3.0

TheAudioDb 1.0.18.0

TheTVDB 1.5.0.0

Webhooks 1.0.35.0

XmlTV 1.2.0.0

Is there something I could see in the full log?

[ebr 16184]

CoverArt doesn't source any artwork.  This is a request for an album cover.  Specifically, an album by "The Ventures".  Looks like it is coming from a metadata provider - possibly MusicBrainz...

[Happy2Play 9781]

Yes that is a Musicbrainz for that specific album as the image in on archive.org.

mbid-bc8d47aa-7892-44a0-85b2-6e6ce974f40c-6741711367.jpg (1000×1000) (archive.org)

Edited August 2, 2024 by Happy2Play

[HokieHi 2]

You guys are freaking amazing.

I think I had a file in that folder that didn't have the correct DRM.

I deleted that and will see if the "suspicious web page" message ends.

Hopefully that takes care of it.

Thanks much

[Lessaj 467]

4 hours ago, ebr said:

CoverArt doesn't source any artwork.  This is a request for an album cover.  Specifically, an album by "The Ventures".  Looks like it is coming from a metadata provider - possibly MusicBrainz...

I wasn't sure since I don't use that plugin and saw coverartarchive.org in the JSON.

[Happy2Play 9781]

1 minute ago, Lessaj said:

I wasn't sure since I don't use that plugin and saw coverartarchive.org in the JSON.

Would have to potentially break down the image request in log but general give away the ID.

 "release": "http://musicbrainz.org/release/bc8d47aa-7892-44a0-85b2-6e6ce974f40c"

or the ID in general as it is used for lookups on provider sites.

[Lessaj 467]

True yes I did see the musicbrainz URL in there as well, didn't try to follow it though.