Comment by ntoskrnl_exe

4 hours ago

I have a question: It seems that all the preview PNGs and the WSZ files themselves are fetched from hxxp://webampskins.org. When I go to that website directly, I get redirected to some shady looking website pushing crypto and gambling. Can you give me some background about this?

2 comments

ntoskrnl_exe

Reply
captbaritone  4 hours ago

Interesting! I've only ever actively used subdomains of webampskins.org, however during early testing I set a hard coded IPV4 IP as the A name for the root domain. Now it looks like that IP has been handed off to someone else who is hosting a spammy site.

Thanks for flagging, I removed that A name record.