Weird and Strange Warning Error From Extremely Popular Android Forum?

Good morning,

Okay so I was a member of this community called the “AndroidForums.com”. One of the biggest communities for the Android OS FOR SURE.

However, recently they changed their domain to “https://forum.earlybird.club” and I keep getting warning messages to not access it. I’ve tried using multiple devices and multiple browsers and multiple OS’ but I keep getting the same warning message?!!?!

WARNING: Do not click “accept and continue” if your web browser displays a warning message about this site because I have no idea if there’s real danger or not!

Sorry if I’m breaking any rules by posting this domain name!

Thank you for reading my question!

what is the warning message?

2 Likes

Quad9 blocks the domain. It blocked it from loading on my browser, so I went to Blocked Domain Tester | Quad9 and to check and it’s blocked.

1 Like

NextDNS also blocked this domain “Blocked by AI-Driven Threat Detection”. It looks like website was hacked.

1 Like

Looks like it. Google Safe Browsing says it’s fine but VirusTotal currently has 7 vendors reporting it as “Malware”, “Malicious” or “Phishing”.

Are you sure androidforums.com is the correct biggest community for android?

When I check the traffic via https://www.similarweb.com/website/androidforums.com/#overview , it just shows 11.4k visits

Meanwhile the one I know https://forums.androidcentral.com has 2.2M visits on https://www.similarweb.com/website/forums.androidcentral.com/#overview


Hmm… Looks really like a valid change? Welcome to the Flock: Android Forums is now Early Bird Club! – Early Bird Club

The announcement was from November 21, 2023.

2 Likes

Maybe it used to be malicious? I just checked the website on my iPhone using Safari and my ISP’s DNS, and it looks safe. Clicking on “Forum” from the main page https://earlybird.club goes to domain that’s blocked. There’s old posts from the early 2010s and newer posts to a few days ago. We can try to get it unblocked.

———

Edit #1: I went to Quad9’s support page and requested it to be removed from their blocklist. I’ll update this post with the outcome.

You are not responsible for this. Let the website maintainers handle it instead. Heed the warning of the sites till the site admin resolves it. As a user, it might be in your self interest to listen to the warnings instead.

If the admins are bad or irresponsible, it speaks volumes to the kind of privacy and security you get. It is not the only android focused forum in the internet. Look elsewhere for the time being.

4 Likes

Something must be going on there… just guys, look here :slight_smile:

People on the website are also mentioning that their ISP and some AVs are blocking the website and it only happened since they changed to the new site. Very odd.

Not so much odd…

My wild guess is that the domain (https(.)earltbird(.)club) had previously been registered to someone who was carrying out shady tactics there and this blockage is a result of these actions.

I appreciate your replies!

This is the error I kept getting after trying to access the site. I kept getting a similar error after trying to access it with different browsers, different devices and different OS’:
“The owner of earlybird.club has configured their web site improperly. To protect your information from being stolen, Firefox has not connected to this web site.

SSL_ERROR_BAD_CERT_DOMAIN

Warning: we can’t confirm your connection to this web site is secure.

It may be a misconfiguration or tampering by an attacker. Proceed if you accept the potential risk.

Okay for some reason I just tried accessing the site and I’m not receiving any errors using Firefox on my Win10 device:

Android Forums

Does this mean it’s safe to use now?

Can anyone else access the site without receiving errors?

NextDNS with all security options enabled except for AI-Driven Threat Detection does not block the website (unsure with AI-Driven Threat Detection enabled), Quad9 still does and on VirusTotal only 2 out of the original 7 AV vendors still say it is malicious.

Make of that what you will.

1 Like

That means exactly what it says: either the site owner improperly configured it (i.e., the SSL cert they used doesn’t apply to the domain it’s attached to) or there is tampering by an attacker (i.e., they’re trying to pass one site off as another). Probably the former and not the latter.

3 Likes

Iewl avast. That’s the “security” company that sells all your data for advertising no?

I probably should write about this topic. You do not need a third party AV. Those days are long over. They are introducing more security and privacy threats than they prevent.

4 Likes