WhyNotWin11.com is not owned by Me #66

sanny-io · 2021-06-27T12:55:40Z

https://www.whynotwin11.com

https://i.imgur.com/6Rlz443.png

I haven't seen this mentioned anywhere. Is this from you @rcmaehl? The download link currently points to this repo's releases, but they might be trying to lay low for a while before switching it out 👀

The text was updated successfully, but these errors were encountered:

rcmaehl · 2021-06-27T12:57:28Z

This website is not owned, operated, or affiliated with me. I'll see if I can get contact information via WHOIS or another means but definitely sketch. It's my fault for not buying the domain

rcmaehl · 2021-06-27T13:02:05Z

Hopefully this is someone trying to be helpful but I'll be reaching out to legal council and will make a case if this becomes an issue.

Add warning banner

krystian3w · 2021-06-27T13:43:12Z

Maybe some hosts project ban page:

https://github.com/StevenBlack/hosts#list-of-all-hosts-file-variants
https://github.com/StevenBlack/hosts#sources-of-hosts-data-unified-in-this-variant

then may no load with NextDNS on default setup.

Improve warning for #66 Fix #64 and change to Yellow ?

krystian3w · 2021-06-27T13:48:26Z

@Yuki2718 can by marked as badware risk this commercial domain? like these: uBlockOrigin/uAssets#1738 uBlockOrigin/uAssets#3060

@spirillen fyi

rcmaehl · 2021-06-27T15:43:21Z

The Reddit Account of the site owner has been found but has been inactive for a couple hours. The situation will be updated as it progresses.

Yuki2718 · 2021-06-27T15:56:53Z

@krystian3w Need evidence the site is actually malicious or dangerous for us to block.

rcmaehl · 2021-06-27T15:59:00Z

@Yuki2718 I believe it's evening time for the current owner, however I've contacted them via several methods and are awaiting a reply. I'll keep you informed if anything changes.

spirillen · 2021-06-27T16:12:59Z

Thanks for your consideration @krystian3w

However, I do not currently see any threats from the domain, however I do believe there are missing a very very important disclaimer about the non-relation to @rcmaehl

If we are scouting the site source code we will find that it yet another wp site and the biggest threat is google, facebook and nocookie.net

When all this said, yes it is ort that all traces of who owns this domain end in a closed reddit account

My conclusion

If things on the site change, yes it would be added, as there currently are nothing dangerous on the site, i would leave it as it is.
It appears mostly like a friendly spider 👾 who helps spreading the word. and the DL links should be monitored and the domain owner should should contact @rcmaehl

HTML decoded

<link rel='dns-prefetch' href='//fonts.googleapis.com' />
	<link rel='stylesheet' id='wp-block-library-css'  href='https://www.whynotwin11.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.2' type='text/css' media='all' />
<link rel='stylesheet' id='yasrcss-css'  href='https://www.whynotwin11.com/wp-content/plugins/yet-another-stars-rating/includes/css/yasr.css?ver=2.8.1' type='text/css' media='all' />
<link rel='stylesheet' id='google-fonts-style-css'  href='https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C500%2C700&#038;display=swap&#038;ver=10.3.8' type='text/css' media='all' />
</div></div></div><div id="pgc-gb14-60d86a683a89c-1-1"  class="panel-grid-cell" ><div id="panel-gb14-60d86a683a89c-1-1-0" class="widget_text so-panel widget widget_custom_html panel-first-child panel-last-child" data-index="2" ><div class="textwidget custom-html-widget"><blockquote class="twitter-tweet"><p lang="en" dir="ltr">WhyNotWin11 is a better replacement for Windows 11&#39;s PC Health Check &#8211; <a href="https://twitter.com/LawrenceAbrams?ref_src=twsrc%5Etfw">@LawrenceAbrams</a><a href="https://t.co/d5UbPNrzgV">https://t.co/d5UbPNrzgV</a></p>&mdash; BleepingComputer (@BleepinComputer) <a href="https://twitter.com/BleepinComputer/status/1408861525939531778?ref_src=twsrc%5Etfw">June 26, 2021</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></div></div></div></div></div><script type="application/ld+json">{"@context":"https:\/\/schema.org\/","@type":"Product","name":"WhyNotWin11","description":"WhyNotWin11 Detection Script to help identify why your PC isn&#8217;t Windows 11 ready Download Version 2.2.2 &nbsp;\u2022&nbsp; 1&nbsp;MB [Total: 1 Average: 5] What is the WhyNotWin11 Tool? WhyNotWin11 is a tool that allows us to check whatever our Computer or Laptop can run Windows 11 or not. Unlike Microsoft&#8217;s Health Check Tool, This WhyNotWin11 Tool...","image":{"@type":"ImageObject","url":"","width":0,"height":0},"Review":null,"aggregateRating":{"@type":"AggregateRating","ratingValue":5,"ratingCount":1,"bestRating":5,"worstRating":1},"brand":"","sku":"","":""}</script>                        </div>
                                            </div>
.game-preloader-thumbnail {
    background-image: url(https://static.wikia.nocookie.net/fridaynightfunkin/images/7/70/FNF_Logo_ba-bumps.gif);
}

pixeye33 · 2021-06-27T17:17:12Z

Since it's not mentioned by anyone yet...

The link to the .exe is no longer pointing to this repo's releases.

The .exe that the website offers does not have the same sha256 signature as the one found in releases (site says it's 2.2.2, i've compared only to this one).

https://www.virustotal.com/gui/ did not find anything.

spirillen · 2021-06-27T17:22:24Z

True...

a class="maxbutton-1 maxbutton maxbutton-download" href="https://www.whynotwin11.com/WhyNotWin11.exe"><span class='mb-text'>Download</span></a></div>

This makes it a malicious site., Thanks for the update @pixeye33

rcmaehl · 2021-06-27T17:24:21Z

This is a comment to provide verification of the @WhyNotWin11 twitter account

pixeye33 · 2021-06-27T17:25:03Z

Correction : exe metadata says its 2.2.4 and the sha256 actually matches the one on the repo...

(for now, is what i implied)

micwoj92 · 2021-06-27T17:26:15Z

Correction : exe metadata says its 2.2.4 and the sha256 actually matches the one an the repo...

Still, it makes no sense to rehost file (with wrong release number) It probably mirrors the link from readme
https://github.com/rcmaehl/WhyNotWin11/releases/latest/download/WhyNotWin11.exe

@spirillen

Closes https://mypdns.org/my-privacy-dns/matrix/-/issues/1835 See also: - rcmaehl/WhyNotWin11#66 Signed by @spirillen Changes to be committed: modified: source/malicious/wildcard.list

rcmaehl · 2021-06-27T17:35:09Z

@Yuki2718 situation has changed a bit. I can understand if you're still hesitant, and I'll tag you in any additional changes, but it appears they're specifically trying to hide the fact of the .com banner warning.

(Which is gonna be a bit hard to do if anyone checks for updates on the app.)

rcmaehl · 2021-06-27T18:15:58Z

Yep, the guy purged information about the owner and the placeholder pages where I had attempted to contact him. I'd rather not involve council butttttttttttt

JourneyOver · 2021-06-27T20:48:31Z

Going through the persons reddit posts (if I am looking at the correct person that is), it looks like they have done this type of stuff before with other things as well, so I wouldn't expect much from them as it looks like they are just up to no good and just taking advantage again of a popular application.

rcmaehl · 2021-06-27T20:49:45Z

Going through the persons reddit posts (if I am looking at the correct person that is), it looks like they have done this type of stuff before with other things as well, so I wouldn't expect much from them as it looks like they are just up to no good and just taking advantage again of a popular application.

They have a few accounts ranging between 5-7 years old. All Generic Middle East names.

JourneyOver · 2021-06-27T20:56:18Z

They have a few accounts ranging between 5-7 years old. All Generic Middle East names.

Ah the only one I've run across so far that has any mention of the website so far is an account named "chardasyaal", but makes sense that they would have multiple accounts. Hopefully you can get the site shut down :/

colenh · 2021-06-27T22:01:54Z

i contacted namecheap via a ticket to report abuse. hope this is solved soon!

spirillen · 2021-06-27T22:37:29Z

I'll be surprised if you can get the domain down.

But what I can't understand... Why are they putting up that domain, hosting an exe (Currently same sha256/md5).

What is there attempted gain here?? there are no banners/ads or severe tracking/spyware (Yet)

But what confuses me more is there usage of a complete WP setup for one page which could be written with have the bits for the frontpage, and not to mention the entire backend (db/wp-code, etc).

rcmaehl · 2021-06-27T23:08:05Z

I'll be surprised if you can get the domain down.

But what I can't understand... Why are they putting up that domain, hosting an exe (Currently same sha256/md5).

What is there attempted gain here?? there are no banners/ads or severe tracking/spyware (Yet)

But what confuses me more is there usage of a complete WP setup for one page which could be written with have the bits for the frontpage, and not to mention the entire backend (db/wp-code, etc).

All I really needed from them was "Hey, I'm X. I'll be sure to keep it the latest build and note that I'm not affiliated somewhere on the page". I would have grabbed the .org anyway (and now have, DNS please propagate)

thepwrtank18 · 2021-07-05T02:13:12Z

how did this turn into a talk about racism

micwoj92 · 2021-07-05T02:14:34Z

Open source is very political.

rcmaehl · 2021-07-05T13:44:38Z

Open source is very political.

👀 Linux Kernel Email threads

iam-py-test · 2021-07-05T14:28:41Z

I tried to access it & I got this error:

It seems someone goofed up and made the cert only valid for the www version.
However, my VM's clock is messed up so I can't connect anyway

spirillen · 2021-07-05T14:34:41Z

God damned.... chrome can be true about itself!!!!

😏 👿 😮

iam-py-test · 2021-07-05T14:39:21Z

... chrome can be true about itself!!!!

😏 👿 😮

What do you mean?
I tried using Firefox and got the same error.
Or are you talking about Chromium's not-so-secret anti-privacy tactics

spirillen · 2021-07-05T14:43:24Z

... chrome can be true about itself!!!!

smirk imp open_mouth

What do you mean?
I tried using Firefox and got the same error.
Or are you talking about Chromium's not-so-secret anti-privacy tactics

google anti-privacy policy, where nothing is private to them, but all about them is private 😏

You know...

||goole.*^

iam-py-test · 2021-07-05T14:44:23Z

... chrome can be true about itself!!!!

smirk imp open_mouth

What do you mean?
I tried using Firefox and got the same error.
Or are you talking about Chromium's not-so-secret anti-privacy tactics

google anti-privacy policy, where nothing is private to them, but all about them is private 😏

You know...

||goole.*^

Ok. I think there is a typo in that filter though.

micwoj92 · 2021-07-05T16:36:43Z

Also, was © WhyNotWin11 is owned by Robert C. Maehl. We are not associated with WhyNotWin11 in any way. This is an unofficial free resource website. always at the bottom of the page?

Nope, it's recent addition.

rcmaehl · 2021-07-05T16:40:36Z

Also, was © WhyNotWin11 is owned by Robert C. Maehl. We are not associated with WhyNotWin11 in any way. This is an unofficial free resource website. always at the bottom of the page?

Nope, it's recent addition.

LGTM.

thepwrtank18 · 2021-07-05T17:04:12Z

their download doesn't even work anymore, just goes back to the home page

rcmaehl · 2021-07-05T17:08:14Z

I'm going to go ahead and close this out. While some people may be confused still, I am happy with the disclaimer. I wish they would have replied via the forwarding service and other contact methods, but I'll continue to keep an eye on the situation.

thepwrtank18 · 2021-07-05T17:08:57Z

We got a good ending (hopefully it stays that way). Good the situation got resolved.

spirillen · 2021-07-05T17:41:44Z

I think we all (BlackList maintainers) should remember to REMOVE whynotwin11.com from our blacklists.... right?

@spirillen

Closes https://mypdns.org/my-privacy-dns/matrix/-/issues/1835 See also: - rcmaehl/WhyNotWin11#66 (comment) Signed by @spirillen Changes to be committed: modified: source/malicious/combined.txt modified: source/malicious/wildcard.list

rcmaehl/WhyNotWin11#66 (comment)

iam-py-test · 2021-07-05T17:50:58Z

Should we report FPs to the AV detections on VirusTotal? (there is now 4)
I have reported to FortiGuard

spirillen · 2021-07-05T18:52:38Z

Should we report FPs to the AV detections on VirusTotal? (there is now 4)
I have reported to FortiGuard

VT is only operating a collection of list / results from external sources, such as @mitchellkrogza's https://github.com/mitchellkrogza/Phishing.Database.

Requesting removal from these lists become the site/domain owners own headache.

iam-py-test · 2021-07-05T19:19:00Z

Should we report FPs to the AV detections on VirusTotal? (there is now 4)
I have reported to FortiGuard

VT is only operating a collection of list / results from external sources, such as @mitchellkrogza's https://github.com/mitchellkrogza/Phishing.Database.

Requesting removal from these lists become the site/domain owners own headache.

If they are legit, that should not be hard & they might want to

MrDavisCSIT · 2021-08-21T13:18:30Z

They admit the program isn't theirs, they might be expecting you to buy the domain from them for a 'reasonable sum'...

twisted-nematic57 · 2021-08-30T19:32:00Z

The ads and the articles at the bottom of the page make it look like the domain was obtained for free.

krystian3w · 2021-08-30T22:50:42Z

More likely, someone is trying to recoup the cash for paying for the hosting/domain.

0xpr03 · 2021-09-01T07:01:44Z

More likely, someone is trying to recoup the cash for paying for the hosting/domain.

You mean the 3€/month webhosting + 10€ domain/year ?

krystian3w · 2021-09-01T07:19:14Z

Yeah ...in Poland ~60-300 zł (13,50-66,50 €) at year if we found good chip hosting/domain renew.

JesseChisholm · 2021-09-26T17:57:30Z

re: waiting for you to buy the domain (for a reasonable fee)
On some registries, you can at least put in for a backorder, if they ever forget to renew.

rcmaehl self-assigned this Jun 27, 2021

rcmaehl added critical Fix Immediately, Literally Destroying the Project as we type help wanted Extra attention is needed labels Jun 27, 2021

rcmaehl changed the title ~~There's a new website up about this project~~ WhyNotWin11.com is not owned by Me Jun 27, 2021

rcmaehl pinned this issue Jun 27, 2021

rcmaehl added a commit that referenced this issue Jun 27, 2021

#66

b8f3dee

Add warning banner

rcmaehl added a commit that referenced this issue Jun 27, 2021

#66, #64

70ed460

Improve warning for #66 Fix #64 and change to Yellow ?

rcmaehl mentioned this issue Jun 27, 2021

line 254 has a "then" that should not be there (i think) #71

Closed

spirillen added a commit to mypdns/matrix that referenced this issue Jun 27, 2021

whynotwin11.com

d9b5e39

Closes https://mypdns.org/my-privacy-dns/matrix/-/issues/1835 See also: - rcmaehl/WhyNotWin11#66 Signed by @spirillen Changes to be committed: modified: source/malicious/wildcard.list

rcmaehl changed the title ~~WhyNotWin11.com is Malware and not owned by Me~~ WhyNotWin11.com is not owned by Me Jul 5, 2021

rcmaehl closed this as completed Jul 5, 2021

iam-py-test mentioned this issue Jul 5, 2021

Remove whynotwin11.com DandelionSprout/adfilt#215

Closed

iam-py-test added a commit to iam-py-test/my_filters_001 that referenced this issue Jul 5, 2021

Remove domain

1d2cc03

rcmaehl/WhyNotWin11#66 (comment)

iam-py-test mentioned this issue Jul 5, 2021

[Remove Request] - whynotwin11.com blocklistproject/Lists#375

Closed

Velgus mentioned this issue Jul 8, 2021

WhyNotWin11 - Badware List uBlockOrigin/uAssets#9566

Closed

6 tasks

WhyNotWin11.com is not owned by Me #66

WhyNotWin11.com is not owned by Me #66

Comments

sanny-io commented Jun 27, 2021 • edited by micwoj92 Loading

rcmaehl commented Jun 27, 2021

rcmaehl commented Jun 27, 2021

krystian3w commented Jun 27, 2021 • edited Loading

krystian3w commented Jun 27, 2021 • edited Loading

rcmaehl commented Jun 27, 2021

Yuki2718 commented Jun 27, 2021

rcmaehl commented Jun 27, 2021 • edited Loading

spirillen commented Jun 27, 2021

My conclusion

pixeye33 commented Jun 27, 2021 • edited Loading

spirillen commented Jun 27, 2021 • edited Loading

rcmaehl commented Jun 27, 2021

pixeye33 commented Jun 27, 2021 • edited Loading

micwoj92 commented Jun 27, 2021

rcmaehl commented Jun 27, 2021

rcmaehl commented Jun 27, 2021

JourneyOver commented Jun 27, 2021

rcmaehl commented Jun 27, 2021

JourneyOver commented Jun 27, 2021

colenh commented Jun 27, 2021

spirillen commented Jun 27, 2021

rcmaehl commented Jun 27, 2021

thepwrtank18 commented Jul 5, 2021

micwoj92 commented Jul 5, 2021

rcmaehl commented Jul 5, 2021

iam-py-test commented Jul 5, 2021 • edited Loading

spirillen commented Jul 5, 2021

iam-py-test commented Jul 5, 2021 • edited Loading

spirillen commented Jul 5, 2021

iam-py-test commented Jul 5, 2021

micwoj92 commented Jul 5, 2021

rcmaehl commented Jul 5, 2021

thepwrtank18 commented Jul 5, 2021

rcmaehl commented Jul 5, 2021

thepwrtank18 commented Jul 5, 2021

spirillen commented Jul 5, 2021 • edited Loading

iam-py-test commented Jul 5, 2021 • edited Loading

spirillen commented Jul 5, 2021

iam-py-test commented Jul 5, 2021

MrDavisCSIT commented Aug 21, 2021

twisted-nematic57 commented Aug 30, 2021

krystian3w commented Aug 30, 2021

0xpr03 commented Sep 1, 2021 • edited Loading

krystian3w commented Sep 1, 2021

JesseChisholm commented Sep 26, 2021

sanny-io commented Jun 27, 2021 •

edited by micwoj92

Loading

krystian3w commented Jun 27, 2021 •

edited

Loading

krystian3w commented Jun 27, 2021 •

edited

Loading

rcmaehl commented Jun 27, 2021 •

edited

Loading

pixeye33 commented Jun 27, 2021 •

edited

Loading

spirillen commented Jun 27, 2021 •

edited

Loading

pixeye33 commented Jun 27, 2021 •

edited

Loading

iam-py-test commented Jul 5, 2021 •

edited

Loading

iam-py-test commented Jul 5, 2021 •

edited

Loading

spirillen commented Jul 5, 2021 •

edited

Loading

iam-py-test commented Jul 5, 2021 •

edited

Loading

0xpr03 commented Sep 1, 2021 •

edited

Loading