5

When I see potential malware posting in a forum or mail, I am sometimes curious what's the content. In this cases I open the URI with archive.is and then see the ad/SPAM.

Is this procedure safe for a macOS user? Is it possible to get somehow infected?

3
  • Is it possible to get somehow infected? Yes.
    – deviantfan
    Sep 3, 2017 at 19:55
  • Why not? Why does it matter if you look at some harmful website content, or a copy the same harmful website content?
    – deviantfan
    Sep 4, 2017 at 16:25
  • 1
    "URLquery" might be something for you if you just want to see how a page looks. It takes a screenshot of the page but does not load you actual content.
    – skooog
    Sep 5, 2017 at 12:47

1 Answer 1

3

Is this procedure safe for a macOS user?

No it's not. And archiving malicious stuff online is bad.

Is it possible to get somehow infected?

Yes.

  • Best case scenario: The URI point to an ad for generating money on click (Not harmful).

  • Worst case scenario: The URI point to a well crafted RCE script, that install a RAT. Welcome to the attacker's botnet.

2
  • Actually archive.is strips any javascript code. You can test this by using archive.is on a benign, ad-heavy website (Alexa top 100) and compare to using an adblocker (e.g. uMatrix). The output's the same. Also, verified via Chrome F12 developer tools for requests. Just don't click on any link, as archive.is will send you to the actual requesting page instead of saving the page link you clicked.
    – grepNstepN
    Oct 6, 2017 at 17:41
  • 1
    after testing a few things, however, it does reveal your IP via x-forwarded-for header. you can test it by using it on icanhazip or another external IP address checker
    – grepNstepN
    Oct 14, 2017 at 20:44

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .