I'm getting spammed with Malwarebytes messages saying that u.cubeupload.com is a trojan.

Event Date and Time Event data Action Location
RTP-detection 29-08-2020 14:49 Trojan horse Blocked website u.cubeupload.com

I know about that HTTP insecure connection thing, but I didn't expect this to happen. It happened after I got a Malwarebytes update.
Is this true, or is it a false positive? Should I whitelist Cubeupload?

AHHHHH CUBEY IS AN TROJAN WE ARE DOOMED!!!
b r u h

But seriously, why would it be a trojan?
I think it's safe, and just a false positive.
(dont blame me if your computer gets infected with CubeyDie)

Let me run the website through VirusTotal, hold on a sec.
Only 3 engines detected u.cubeupload.com as a virus, but 3 is a pretty small number, so I think you will be fine and that it is a false positive.

I know other people had reports of cubeupload setting off their antivirus as a false positive. It is a legitimate image host, otherwise I'm sure it'd be off the whitelist at this point

CatsUnited wrote:

I know other people had reports of cubeupload setting off their antivirus as a false positive. It is a legitimate image host, otherwise I'm sure it'd be off the whitelist at this point

Wait, there are more repros? Can you link to one?

Also, I noticed u.cubeupload.com or i.cubeupload.com gets blocked, but cubeupload.com not. IDK why.
It happens on this topic too due to @4096bits' signature aaaaa

4096bits wrote:

Only 3 engines detected u.cubeupload.com as a virus, but 3 is a pretty small number, so I think you will be fine and that it is a false positive.

Okay then, I guess I will whitelist it later.

If cubey becomes a virus then my life has ended. Anyway, it probably has something to do with the HTTP connection, but I'm not sure. Scan it through as many antivirus software as possible, that's my only advice.

geometric_ghast wrote:

If cubey becomes a virus then my life has ended. Anyway, it probably has something to do with the HTTP connection, but I'm not sure. Scan it through as many antivirus software as possible, that's my only advice.

@4096bits scanned it with VirusTotal and 3 engines (virus scanners) detected it.

Boomer001 wrote:

It happens on this topic too due to @4096bits' signature aaaaa

w h a t I don't have cubeupload that's cdn2.scratch.mit.edu

Here's some photos of the scan:


And no, http:// and https:// protocols do not matter for the first result.

According to VirusTotal, three engines detected malicious content on u.cubeupload.com and 2 on i.cubeupload.com.
omg i'm such a big egg for putting this in mysiggy

-InsanityPlays- wrote:

According to VirusTotal, three engines detected malicious content on u.cubeupload.com and 2 on i.cubeupload.com.

I already scanned it, don't worry.

4096bits wrote:

Boomer001 wrote:

It happens on this topic too due to @4096bits' signature aaaaa

w h a t I don't have cubeupload that's cdn2.scratch.mit.edu

I have a userstyle that adds scrollbars to signatures, and further down your siggy, there is an image with this URL:
http://u.cubeupload.com/InsanityPlays/wp9756.png

Boomer001 wrote:

4096bits wrote:

Boomer001 wrote:

It happens on this topic too due to @4096bits' signature aaaaa

w h a t I don't have cubeupload that's cdn2.scratch.mit.edu

I have a userstyle that adds scrollbars to signatures, and further down your siggy, there is an image with this URL:
http://u.cubeupload.com/InsanityPlays/wp9756.png

Oh, OK. I completely forgot about that

Okay, I have added i.cubeupload.com and u.cubeupload.com to the whitelist of Malwarebytes. I think it is a false positive. Any drive-by downloads will probably get detected by Malwarebytes. I will keep the topic open, so the conversation can continue.

According to a Reddit post:

After doing some checking up, it appears they had an issue in the past where users would upload exe files with image extensions in order to push viruses on unsuspecting people (not cool). Now, the site says they have updated their protection methods, and that they contacted the software companies who's anti-malware programs were blocking the site, and said that they agreed to remove cubeupload off the block list: https://blog.cubeupload.com/2017/10/malwarebytes-blocking/

(the blog link is dead)
It now has protection, so that probably means it's safe. But it still isn't removed off the block list.

bump